CVE-2026-69229: HTML injection vulnerability in Esri Portal for ArcGIS
There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 and 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must be authenticated to Portal for ArcGIS and have the ability to insert content into the Portal for ArcGIS Home application. No user interaction is required for the attacker to submit the injected HTML.
Which deployments should be prioritized for patching?
ArcGIS Enterprise 11.1, 11.3, 11.5, and 12.0 are specifically identified for patching. The issue affects Portal for ArcGIS version 12.0 and prior; users are advised to upgrade to the latest long-term support release.