CVE-2026-69231: stored cross site scripting issue in Esri Portal for ArcGIS
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For Esri Portal for ArcGIS, mitigate the stored cross-site scripting risk by limiting access to the Portal until patches are applied (as ArcGIS Enterprise 11.1, 11.3, 11.5 and prior are affected).
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker needs privileged access to Portal for ArcGIS to inject the malicious stored content. Exploitation does not require victim interaction beyond the victim viewing content that causes the injected JavaScript to execute in their browser.
Which deployments should be prioritized for remediation?
Portal for ArcGIS 11.5 and earlier are affected. Users of ArcGIS Enterprise 11.1, 11.3, and 11.5 are specifically encouraged to patch, and all users are advised to upgrade to the latest long-term support release.