CVE-2026-69238: HTML injection vulnerability in Esri Portal for ArcGIS
There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Esri Portal for ArcGIS (ArcGIS Enterprise)to a version that resolves this vulnerability.Fixed in 11.5 - Upgrade
Upgrade
Esri Portal for ArcGIS (ArcGIS Enterprise)to a version that resolves this vulnerability.Fixed in 11.3 - Upgrade
Upgrade
Esri Portal for ArcGIS (ArcGIS Enterprise)to a version that resolves this vulnerability.Fixed in 11.1
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must already have high privileges in Portal for ArcGIS. Exploitation also requires a user to interact with the injected HTML.
Which deployments should be prioritized for patching?
Portal for ArcGIS 11.5 and earlier are affected. The advisory specifically encourages users of ArcGIS Enterprise 11.1, 11.3, and 11.5 to patch, and advises all users to upgrade to the latest long-term support release.
What is the likely impact if exploitation succeeds?
An attacker can insert arbitrary HTML into the Portal for ArcGIS Home application. The stated impact is limited confidentiality and integrity loss, with no availability impact indicated.