CVE-2026-69234 in Portal for ArcGIS
Summary
by MITRE • 08/22/2026
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release. Users working with ArcGIS Web App Builder developer edition are advised to migrate to ArcGIS Experience Builder, as ArcGIS Web App Builder developer edition is unsupported when this CVE is assigned.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The identified vulnerability represents a classic reflected cross-site scripting (XSS) flaw within Esri Portal for ArcGIS software versions 11.5 and earlier. This security defect allows remote, unauthenticated attackers to inject malicious script payloads into HTTP requests that are subsequently returned by the server without proper sanitization or encoding. When an unsuspecting user clicks on a specially crafted link containing this payload, their browser executes the embedded JavaScript code within the context of the vulnerable application. Because the execution occurs in the victim’s browser session with active authentication tokens and privileges associated with the Portal for ArcGIS instance, the attacker can potentially hijack user sessions, steal sensitive data such as credentials or configuration details, perform actions on behalf of the victim, or redirect users to malicious sites designed for phishing attacks.
From a technical perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The root cause typically involves insufficient validation and encoding of user-supplied input that is reflected back in the HTTP response. In the context of ArcGIS Enterprise environments, which often handle sensitive geospatial data and administrative configurations, the impact extends beyond simple session hijacking. An attacker could manipulate map views, alter layer visibility settings, or exfiltrate configuration files if the executed script has access to privileged APIs exposed by the portal interface. The lack of authentication requirement for exploitation significantly lowers the barrier to entry for attackers, enabling widespread automated attacks via social engineering tactics such as phishing emails or compromised websites hosting malicious links.
The operational impact on organizations utilizing ArcGIS Enterprise versions 11.1, 11.3, and 11.5 is substantial. These systems often serve as central hubs for geographic information system operations, meaning a successful exploitation could compromise the integrity of spatial data analysis workflows. Attackers might use the compromised session to modify shared maps or layers, leading to misinformation in critical decision-making processes that rely on accurate geospatial intelligence. Furthermore, since ArcGIS Portal is frequently integrated with other enterprise systems through single sign-on mechanisms, compromising an administrator account via this XSS vector could provide a foothold for lateral movement within the broader network infrastructure. This scenario corresponds to ATT&CK technique T1059, Command and Scripting Interpreter, specifically JavaScript execution in browser contexts, which facilitates further malicious activities such as credential harvesting or malware deployment through drive-by downloads linked from the compromised session.
To mitigate this risk, immediate action is required for all affected systems. Users operating ArcGIS Enterprise versions 11.1, 11.3, and 11.5 are strongly advised to apply available patches that address this specific vulnerability as soon as possible. For organizations seeking a more robust long-term solution, upgrading to the latest long-term support release of Esri Portal for ArcGIS is recommended, as these updates include comprehensive security hardening measures and updated input validation frameworks designed to prevent reflection-based attacks. Additionally, users currently relying on ArcGIS Web App Builder developer edition should plan a migration to ArcGIS Experience Builder. This transition is critical not only because the newer platform offers enhanced security features but also because the older developer edition has reached end-of-life status and no longer receives security updates or support from Esri following the assignment of this CVE identifier. Implementing web application firewalls with strict input filtering rules can provide an additional layer of defense by blocking known malicious patterns before they reach the vulnerable application logic, thereby reducing the attack surface while patching efforts are underway.