CVE-2026-69234: reflected cross site scripting vulnerability in Esri Portal for ArcGIS

Published Aug 21, 2026
·
Updated

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release. Users working with ArcGIS Web App Builder developer edition are advised to migrate to ArcGIS Experience Builder, as ArcGIS Web App Builder developer edition is unsupported when this CVE is assigned.

Affected Software

1 affected component
Esri Portal for ArcGIS<=11.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Esri Portal for ArcGIS to a version that resolves this vulnerability.

    Fixed in 11.5
  2. Upgrade

    Upgrade ArcGIS Enterprise (Portal for ArcGIS) to a version that resolves this vulnerability.

    Fixed in 11.1
  3. Upgrade

    Upgrade ArcGIS Enterprise (Portal for ArcGIS) to a version that resolves this vulnerability.

    Fixed in 11.3
  4. Remove

    Remove ArcGIS Web App Builder developer edition from your environment.

    Migrate off ArcGIS Web App Builder developer edition because it is unsupported when this CVE is assigned.

  5. Compensating control

    For Esri Portal for ArcGIS versions 11.5 and prior, mitigate reflected XSS risk by preventing users from clicking untrusted crafted links until patched.

Event History

Aug 21, 2026
CVE Published
via MITRE·08:54 PM
Data Sourced
via MITRE·08:54 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What must an attacker do to exploit this issue?

An attacker must create and deliver a crafted link, then convince a victim to click it. No attacker authentication is required, but user interaction is required.

2

What is the impact if the crafted link is opened?

The link may cause arbitrary JavaScript to execute in the victim's browser. The listed impact includes limited confidentiality and integrity effects, with no availability impact.

3

Which deployments should be prioritized for remediation?

Esri specifically encourages patching for ArcGIS Enterprise 11.1, 11.3, and 11.5. Portal for ArcGIS 11.5 and earlier are affected, and all users are advised to upgrade to the latest long-term support release.

4

What should organizations using ArcGIS Web App Builder developer edition do?

Migrate to ArcGIS Experience Builder. ArcGIS Web App Builder developer edition was unsupported when this CVE was assigned.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203