CVE-2026-69234: reflected cross site scripting vulnerability in Esri Portal for ArcGIS
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release. Users working with ArcGIS Web App Builder developer edition are advised to migrate to ArcGIS Experience Builder, as ArcGIS Web App Builder developer edition is unsupported when this CVE is assigned.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Esri Portal for ArcGISto a version that resolves this vulnerability.Fixed in 11.5 - Upgrade
Upgrade
ArcGIS Enterprise (Portal for ArcGIS)to a version that resolves this vulnerability.Fixed in 11.1 - Upgrade
Upgrade
ArcGIS Enterprise (Portal for ArcGIS)to a version that resolves this vulnerability.Fixed in 11.3 - Remove
Remove
ArcGIS Web App Builder developer editionfrom your environment.Migrate off ArcGIS Web App Builder developer edition because it is unsupported when this CVE is assigned.
- Compensating control
For Esri Portal for ArcGIS versions 11.5 and prior, mitigate reflected XSS risk by preventing users from clicking untrusted crafted links until patched.
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must create and deliver a crafted link, then convince a victim to click it. No attacker authentication is required, but user interaction is required.
What is the impact if the crafted link is opened?
The link may cause arbitrary JavaScript to execute in the victim's browser. The listed impact includes limited confidentiality and integrity effects, with no availability impact.
Which deployments should be prioritized for remediation?
Esri specifically encourages patching for ArcGIS Enterprise 11.1, 11.3, and 11.5. Portal for ArcGIS 11.5 and earlier are affected, and all users are advised to upgrade to the latest long-term support release.
What should organizations using ArcGIS Web App Builder developer edition do?
Migrate to ArcGIS Experience Builder. ArcGIS Web App Builder developer edition was unsupported when this CVE was assigned.