CVE-2026-69237: HTML injection vulnerability in Esri Portal for ArcGIS
There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Esri Portal for ArcGISto a version that resolves this vulnerability.Fixed in 11.3
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must already have administrative privileges in Esri Portal for ArcGIS. The vulnerability allows that administrator-level attacker to insert arbitrary HTML through an administrative API.
Which deployments should be prioritized for patching?
Portal for ArcGIS versions 11.3 and earlier are affected. The provided advisory specifically encourages users of ArcGIS Enterprise 11.1 and 11.3 to patch, and advises all users to upgrade to the latest long-term support release.