CVE-2026-50096 in Portal for ArcGIS
Summary
by MITRE • 10/26/2026
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
Esri Portal for ArcGIS versions 12.1 and prior contain a reflected cross-site scripting vulnerability that poses significant risks to users interacting with the platform through web browsers. This security flaw allows remote, unauthenticated attackers to craft malicious links containing injected JavaScript payloads. When an unsuspecting victim clicks on such a link, the browser executes the arbitrary code within the context of the vulnerable application. Because the attack vector relies on user interaction via clicking a crafted URL, it falls under the category of reflected XSS where the payload is not stored in the server but rather passed through request parameters and immediately returned to the client for execution.
The technical nature of this vulnerability stems from insufficient input validation or output encoding mechanisms within the application's handling of specific query parameters or user-supplied data. When the malicious script is embedded in a URL parameter, the server reflects it back in the HTTP response without properly sanitizing the content. Consequently, the victim’s browser interprets the injected code as legitimate part of the web page, granting the attacker the ability to execute scripts with the same privileges and permissions as the authenticated user or the application itself. This can lead to session hijacking, credential theft via keylogging, defacement of the user interface, or redirection to phishing sites designed to harvest sensitive information.
From an operational perspective, this vulnerability enables a remote attacker who is unauthenticated to compromise the integrity and confidentiality of data accessed through Esri Portal for ArcGIS. The impact extends beyond simple script execution; it can facilitate broader attacks such as cross-site request forgery if combined with other vulnerabilities or allow attackers to bypass access controls by manipulating session tokens stored in cookies or local storage. Organizations relying on these versions face potential exposure of sensitive geospatial data and user credentials, which undermines trust in the platform’s security posture. The risk is particularly acute for environments where users frequently share links containing dynamic parameters, as the attack requires no prior authentication but does depend on social engineering tactics to lure victims into clicking malicious URLs.
Mitigation strategies primarily involve applying the official patch provided by Esri for ArcGIS Server software that is in General Availability or Extended support status. These supported versions include 12.1, 12.0, 11.5, 11.3, and 11.1. It is critical to verify the current version of your deployment against this list before proceeding with updates. For users operating on unlisted versions that are in mature or retired status, patching may not be directly available through standard update channels. In such cases, upgrading to a supported release is strongly advised to ensure continued security maintenance and access to vulnerability fixes. Additionally, implementing web application firewalls can provide an additional layer of defense by filtering out known malicious patterns associated with XSS attacks while patches are being deployed or evaluated for compatibility within the organization’s infrastructure.
This incident aligns with Common Weakness Enumeration identifier CWE-79, which classifies improper neutralization of input during web page generation as a cross-site scripting vulnerability. Furthermore, from an adversary tactics perspective, this exploitation method corresponds to ATT&CK technique T1059, specifically sub-techniques involving command and script interpreters like JavaScript within browser environments. Understanding these mappings helps security teams prioritize remediation efforts based on standardized frameworks that describe both the root cause of the weakness and its potential use in real-world attack scenarios. Organizations should also consider enhancing monitoring capabilities to detect unusual patterns of URL parameters being passed through their web applications, which could indicate attempted exploitation of this reflected XSS flaw.