CVE-2026-69236 in Portal for ArcGIS
Summary
by MITRE • 08/21/2026
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, 12.0 or 12.1 are encouraged to patch. All users are advised to upgrade to the latest long-term support release and apply the patch.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in Esri Portal for ArcGIS versions 12.1 and prior represents a significant security risk classified as a Stored Cross-Site Scripting flaw, commonly referenced under CWE-79 in industry standard taxonomies. This type of vulnerability occurs when an application stores untrusted data without proper validation or encoding before including it in future web pages. In the specific context of Esri Portal for ArcGIS, this architectural weakness allows malicious actors to inject scripts into stored content that is subsequently served to other users. Unlike reflected XSS where the payload is delivered via a crafted link, stored XSS persists on the server side, meaning every user who views the compromised page or data set becomes a potential victim without any additional interaction required from the attacker beyond the initial injection.
The operational impact of this vulnerability is severe due to its ability to facilitate remote code execution within the context of the victim's browser session. A remote, privileged attacker can exploit this flaw by injecting malicious JavaScript code into areas where user-supplied input is rendered back to other users without sanitization. Once executed, this arbitrary JavaScript runs with the same privileges as the legitimate application scripts, granting the attacker access to sensitive information such as session cookies, authentication tokens, and personally identifiable data stored within the portal. Furthermore, the attacker can perform actions on behalf of the victim, including modifying account settings, creating new administrative users, or manipulating geographic data visualizations, thereby compromising the integrity and confidentiality of the entire ArcGIS Enterprise environment.
The scope of this vulnerability affects a wide range of deployments, specifically impacting Esri Portal for ArcGIS versions 12.1 and earlier, as well as associated components within ArcGIS Enterprise versions 11.1, 11.3, 11.5, 12.0, and 12.1. This broad impact surface underscores the necessity for immediate remediation across all affected installations. The vulnerability aligns with ATT&CK technique T1189 Drive-by Client Side Scripting, as it involves delivering malicious code that executes automatically upon viewing compromised content. It also relates to T1059 Command and Control via Web Protocols if the injected script is used to exfiltrate data or establish persistent backdoors within the network perimeter.
To mitigate this risk, organizations must prioritize patching their Esri Portal for ArcGIS instances immediately. The recommended course of action involves upgrading to the latest long-term support release provided by Esri, which includes comprehensive security fixes and hardened input validation mechanisms. For environments that cannot yet upgrade to the newest version, applying the specific vendor-provided patches is essential to close the code execution gap. Additionally, administrators should implement strict content filtering policies within the portal configuration where possible, ensuring that all user-generated inputs are rigorously validated against a whitelist of allowed characters and encoded appropriately before storage or rendering. Regular security audits and penetration testing focused on input validation flaws will further help in identifying similar vulnerabilities across the broader ArcGIS ecosystem.