CVE-2026-69230: stored cross site scripting issue in Esri Portal for ArcGIS
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires a remote attacker with administrative privileges in Portal for ArcGIS. The attacker can store malicious code that may later execute in another user's browser.
Which deployments should be prioritized for remediation?
Portal for ArcGIS versions 11.5 and earlier are affected. Users of ArcGIS Enterprise 11.1, 11.3, and 11.5 are specifically encouraged to patch, and all users are advised to upgrade to the latest long-term support release.
What is the likely impact if exploitation succeeds?
The stored script may execute in a victim's browser, potentially allowing the attacker to run arbitrary code in that browser context. The reported impact includes low confidentiality and integrity effects, with no availability impact stated.