CVE-2026-69235 in Portal for ArcGIS
Summary
by MITRE • 08/22/2026
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified as a stored cross-site scripting (XSS) flaw in Esri Portal for ArcGIS versions 11.5 and prior represents a significant security risk within geographic information system environments that rely heavily on web-based interfaces for data visualization, management, and collaboration. Unlike reflected XSS attacks which require the victim to click a malicious link, this stored variant persists on the target server or database, meaning that every user who accesses the compromised page is exposed to the injected script without any additional interaction from the attacker beyond the initial injection point. This persistence mechanism amplifies the potential blast radius of the attack, as the malicious payload becomes an integral part of the application's content and is served dynamically to all authenticated users visiting specific sections of the portal where the tainted data is displayed.
The technical root cause lies in the insufficient validation or sanitization of user-supplied input before it is stored by the application backend. When a privileged attacker, such as an administrator or a user with elevated permissions within the ArcGIS Enterprise environment, submits content containing malicious JavaScript code through any writable field that is later rendered on a web page without proper encoding, the browser interprets this code as legitimate script from the portal's domain. This bypasses same-origin policy restrictions, allowing the attacker to execute arbitrary commands in the context of the victim’s session. The attack vector typically involves injecting scripts into fields such as item descriptions, comments, tags, or other metadata entries that are subsequently rendered on public-facing pages or dashboards within the ArcGIS Enterprise suite.
The operational impact of this vulnerability is severe due to the high privilege level often associated with users who can inject persistent content in Esri Portal for ArcGIS. An attacker leveraging this flaw can perform a wide range of malicious activities, including session hijacking by stealing authentication cookies and tokens, which would allow them to impersonate legitimate users or escalate privileges within the GIS infrastructure. Furthermore, the attacker could conduct keylogging to capture sensitive credentials, redirect users to phishing sites designed to steal further information, or manipulate the visual presentation of geographic data to mislead decision-makers relying on accurate spatial analytics. In enterprise environments where ArcGIS is critical for operational intelligence, such manipulation can lead to significant business disruption and loss of trust in the integrity of geospatial data.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of storing malicious content for later execution places it firmly within the stored XSS category rather than reflected or DOM-based variants. In terms of adversary tactics and techniques, this exploit maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically JavaScript sub-technique, as well as T1204 User Execution if social engineering is used to trigger the initial view by victims. The persistence aspect also relates to T1505 Server Software Component, where the attacker establishes a foothold within the application's data layer rather than just executing code transiently in memory.
To mitigate this risk and prevent future occurrences of stored cross-site scripting attacks, organizations must implement strict input validation and output encoding strategies across all web applications interacting with user-supplied data. This involves ensuring that any special characters such as angle brackets, ampersands, quotes, and other HTML metacharacters are properly encoded before being rendered in the browser context. Additionally, implementing a Content Security Policy (CSP) can provide an additional layer of defense by restricting the sources from which scripts can be loaded and executed, thereby neutralizing many XSS payloads even if they manage to bypass input filters. For immediate remediation, Esri has released patches for ArcGIS Enterprise versions 11.1, 11.3, and 11.5 that address these specific flaws in the portal's rendering engine.
It is strongly recommended that all organizations utilizing Esri Portal for ArcGIS upgrade to the latest long-term support release immediately after applying available security updates. Regular patching cycles are essential to maintain a secure posture against evolving web application vulnerabilities. Security administrators should also audit existing content within their portals for any previously injected malicious scripts, as stored XSS payloads may persist even after software patches if not manually cleaned from the database. Implementing automated vulnerability scanning tools that specifically test for persistent input validation flaws can help identify similar weaknesses in custom integrations or extensions built on top of the ArcGIS platform before they are exploited by adversaries.