CVE-2026-69233 in Portal for ArcGIS
Summary
by MITRE • 08/22/2026
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified involves a stored cross-site scripting flaw within Esri Portal for ArcGIS versions 11.5 and earlier. This security defect allows an attacker who has already obtained administrative privileges on the platform to inject malicious script code into content that is subsequently served to other users. Unlike reflected XSS attacks where the payload is delivered via a crafted link, stored cross-site scripting involves persisting the malicious input within the application's database or storage mechanism. When legitimate administrators or authorized users access the compromised page or view the affected data, their browsers execute the injected script in the context of the vulnerable web application. This persistence ensures that every user interacting with the tainted content is exposed to the attack without requiring additional social engineering tactics beyond initial administrative compromise.
The technical root cause lies in insufficient input validation and output encoding mechanisms within the Portal for ArcGIS interface. When an administrator submits data containing script tags or event handlers, the system fails to properly sanitize these inputs before storing them. Consequently, when this content is rendered back to users' browsers, it is interpreted as executable code rather than plain text. This failure in sanitization allows the attacker to bypass standard browser security policies such as the same-origin policy, enabling the script to access sensitive cookies, session tokens, and other protected resources associated with the user's active session on the ArcGIS Enterprise environment.
The operational impact of this vulnerability is severe due to the high privilege level required for exploitation. Since the attack vector requires administrative privileges, it typically indicates that an attacker has already gained a foothold within the organization’s network or compromised an administrator account through other means such as credential theft or phishing. Once executed, the malicious code can perform actions on behalf of the victim user. This includes stealing session cookies to hijack active sessions, redirecting users to malicious sites for further exploitation, capturing keystrokes to harvest additional credentials, or manipulating the DOM to display deceptive content that mimics legitimate ArcGIS interfaces. In an enterprise GIS environment where sensitive spatial data and critical infrastructure information are managed, such a breach can lead to significant data exfiltration, integrity compromise of geographic datasets, and disruption of operational workflows dependent on accurate map services.
Mitigation strategies focus primarily on software updates and access control hardening. Esri has addressed this issue in subsequent releases, making it imperative for all users running ArcGIS Enterprise versions 11.1, 11.3, and 11.5 to apply the latest available patches immediately. For organizations unable to patch immediately due to operational constraints, implementing strict web application firewalls with rules designed to detect and block common XSS payloads in HTTP requests can provide a layer of defense-in-depth. Additionally, enforcing multi-factor authentication for all administrative accounts reduces the likelihood of initial compromise that leads to this vulnerability being exploited. Regular security audits and penetration testing should be conducted to identify similar input validation weaknesses across other components of the ArcGIS Enterprise stack.
From an industry standard perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting (XSS). The specific nature of storing malicious content for later execution classifies it under CWE-80: Persistent XSS. In terms of the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Collection via Browser Hijacking and Credential Access through Stealing Web Session Cookies. Attackers leveraging this flaw would likely follow a path consistent with Initial Compromise leading to Lateral Movement or Data Exfiltration within the enterprise network. Organizations should treat this as a critical risk requiring immediate remediation due to its potential for widespread impact on data confidentiality and integrity once administrative access is obtained.