CVE-2026-69236: stored cross site scripting issue in Esri Portal for ArcGIS
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, 12.0 or 12.1 are encouraged to patch. All users are advised to upgrade to the latest long-term support release and apply the patch.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, 12.0, or 12.1 are specifically encouraged to patch. The issue is described as affecting Esri Portal for ArcGIS 12.1 and prior.
What access does an attacker need to exploit this issue?
The description identifies the attacker as remote and privileged, meaning exploitation requires privileges in the affected environment. Successful exploitation also depends on a victim viewing the stored malicious content in a browser.
What is the impact if exploitation succeeds?
Injected malicious code may execute arbitrary JavaScript in the victim's browser. The supplied severity vector indicates potential low-impact confidentiality and integrity effects, with no indicated availability impact.
What should organizations do if they are running an affected release?
Apply the available patch for the affected ArcGIS Enterprise release. All users are also advised to upgrade to the latest long-term support release and apply the patch.