CVE-2026-69231 in Portal for ArcGIS
Summary
by MITRE • 08/21/2026
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified as a stored cross-site scripting (XSS) flaw in Esri Portal for ArcGIS versions 11.5 and prior represents a significant security risk within geographic information system deployments that rely on this enterprise platform. Stored XSS, also known as persistent XSS, differs from reflected variants because the malicious script is permanently stored on the target server, typically within a database or content repository, rather than being embedded in a single HTTP request. This persistence ensures that every user who accesses the affected page or feature containing the injected payload will execute the malicious code without any additional interaction required by the attacker beyond the initial injection. In the context of Esri Portal for ArcGIS, this vulnerability allows a remote, privileged attacker to inject JavaScript into areas where user-supplied input is processed and rendered back to other users without adequate sanitization or encoding checks.
The technical flaw stems from insufficient validation of input data within specific components of the ArcGIS Enterprise architecture. When an authenticated user with elevated privileges submits content that includes script tags or event handlers, the system fails to properly neutralize these elements before storing them for later retrieval and display. Consequently, when other users view this compromised content through their web browsers, the browser interprets the stored scripts as legitimate code belonging to the portal domain. This execution occurs within the security context of the trusted site, granting the attacker access to sensitive cookies, session tokens, local storage data, or the ability to perform actions on behalf of the victim user. The severity is amplified by the fact that the attacker must possess privileged credentials, which limits the attack surface but increases the potential impact if those credentials are compromised through phishing, credential stuffing, or other privilege escalation techniques.
The operational impact of this vulnerability extends beyond simple script execution. An attacker leveraging this flaw can conduct session hijacking attacks to impersonate legitimate users, potentially gaining unauthorized access to sensitive geographic data and administrative functions within the ArcGIS Enterprise environment. Furthermore, the malicious code could be used to deface web pages, redirect users to phishing sites designed to steal additional credentials, or deploy further malware onto client machines if combined with other browser vulnerabilities. For organizations relying on Esri Portal for critical infrastructure mapping, urban planning, or environmental monitoring, such a breach compromises data integrity and confidentiality, potentially leading to significant operational disruptions and loss of trust among stakeholders who depend on the accuracy and security of the platform's outputs.
Industry standards classify this type of vulnerability under CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting. Specifically, it aligns with ATT&CK technique T1059.007, which covers JavaScript execution within web browsers. The persistence aspect places it firmly in the realm of stored attacks, where the malicious payload remains active until manually removed from the database or application logic is patched. Security frameworks emphasize that such vulnerabilities often result from a lack of consistent input validation strategies across all user-facing endpoints and APIs within an enterprise application suite.
To mitigate this risk, Esri has released patches for ArcGIS Enterprise versions 11.1, 11.3, and 11.5 to address the specific code paths responsible for the improper handling of untrusted data. Organizations are strongly encouraged to apply these updates immediately to close the security gap. Additionally, all users should plan an upgrade to the latest long-term support release, which incorporates more robust input validation mechanisms and enhanced security controls designed to prevent similar injection attacks in future versions. Beyond patching, administrators should implement strict content security policies (CSP) within their web servers or reverse proxies to restrict script execution sources, although this serves as a compensating control rather than a fix for the underlying application flaw. Regular vulnerability assessments and penetration testing focused on input validation across all user roles can further help identify and remediate similar weaknesses before they are exploited in production environments.