CVE-2026-69235: stored cross site scripting issue in Esri Portal for ArcGIS
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Esri Portal for ArcGIS (ArcGIS Enterprise)to a version that resolves this vulnerability.Fixed in 11.5 and prior
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
ArcGIS Enterprise deployments using versions 11.1, 11.3, or 11.5 are specifically identified for patching. The issue affects Esri Portal for ArcGIS version 11.5 and earlier, and all users are advised to move to the latest long-term support release.
What access does an attacker need to exploit this issue?
The description identifies the attacker as remote and privileged, so exploitation requires privileges in the affected environment. A victim must also interact with the stored malicious content for code to execute in that victim's browser.
What is the likely impact if exploitation succeeds?
Injected malicious code may execute in a victim's browser. The supplied severity vector indicates low confidentiality and integrity impact, with no availability impact.