CVE-2026-69229: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Esri Portal for ArcGIS

This vulnerability (CWE-79) in Esri Portal for ArcGIS allows an authenticated remote attacker to perform HTML injection in the Portal for ArcGIS Home application. The affected versions include 11.1, 11.3, 11.5, and 12.0. The vulnerability enables insertion of arbitrary HTML, which could lead to cross-site scripting attacks. The CVSS 3.1 base score is 5.4, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation could allow an attacker to inject malicious HTML content into the Portal for ArcGIS Home application, potentially leading to limited confidentiality and integrity impacts. There is no indication of availability impact. The attacker must be authenticated to exploit this vulnerability.

Users of affected versions (11.1 through 12.0) are encouraged to patch or upgrade to the latest long-term support release of Portal for ArcGIS. No specific patch links are provided in the input data; therefore, users should consult Esri's official advisories for patch availability and installation instructions. Since this is not a cloud service, remediation depends on user action.