CVE-2026-69230 in Portal for ArcGIS
Summary
by MITRE • 08/22/2026
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified involves a stored cross-site scripting flaw within Esri Portal for ArcGIS versions 11.5 and earlier. This security defect allows an attacker who has already obtained administrative privileges on the platform to inject malicious script code into content that is subsequently served to other users. Unlike reflected XSS attacks where payload delivery requires tricking a user into clicking a crafted link, stored cross-site scripting persists within the application's database or storage mechanism. Consequently, every time a victim accesses the compromised page or feature, the injected scripts are executed automatically by their web browser without further interaction from the attacker. This persistence makes the vulnerability particularly dangerous as it can affect multiple users over an extended period until the malicious content is removed and patches are applied.
From a technical perspective, this flaw represents a failure in input validation and output encoding mechanisms within the application's server-side processing logic. When administrative users create or modify portal items such as web maps, dashboards, or custom applications, the system fails to properly sanitize special characters that have executable meaning in HTML and JavaScript contexts. This allows script tags or event handlers containing malicious code to be stored alongside legitimate data. The operational impact is severe because it enables arbitrary code execution within the context of the victim's browser session. Attackers can leverage this capability to steal sensitive information such as session cookies, authentication tokens, or personally identifiable information displayed on the portal interface. Furthermore, they may perform actions on behalf of the user, modify content, or redirect victims to phishing sites designed to harvest credentials for other systems integrated with ArcGIS Enterprise.
This vulnerability aligns closely with Common Weakness Enumeration identifier CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under the subcategory of Stored XSS where malicious scripts are permanently stored on target servers. In terms of offensive security frameworks, this exploit maps to MITRE ATT&CK technique T1059 Command and Control via Application Layer Protocol or more specifically T1189 Drive-by Client Side Scripting if used for initial access through compromised content, though in this context it is primarily utilized for post-exploitation activities such as credential theft (T1539 Steal Web Session Cookie) and unauthorized actions. The requirement for administrative privileges to trigger the injection indicates that while the impact is high, the attack vector requires a higher level of initial compromise compared to unauthenticated vulnerabilities.
To mitigate this risk, organizations running Esri Portal for ArcGIS versions 11.5 or prior must apply the latest security patches provided by Esri immediately. The vendor has addressed these issues in subsequent releases and strongly recommends that all users upgrade to the most recent long-term support release of ArcGIS Enterprise. This ensures access not only to this specific fix but also to other critical security improvements and stability enhancements released over time. In addition to patching, administrators should enforce strict role-based access controls to limit who can create or modify portal content. Implementing a Content Security Policy header within the web server configuration can further reduce the impact of any remaining XSS vulnerabilities by restricting the sources from which scripts are allowed to execute. Regular security audits and penetration testing focused on input validation across all user-facing endpoints should also be conducted to identify similar weaknesses before they can be exploited in production environments.