CVE-2026-69230: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Esri Portal for ArcGIS

This vulnerability (CVE-2026-69230) is a stored cross-site scripting (CWE-79) flaw in Esri Portal for ArcGIS. It affects versions 11.1 through 11.5, allowing a remote attacker with administrative privileges to inject malicious scripts that execute in the context of other users' browsers. The CVSS 3.1 score is 5.5 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality and integrity with no availability impact. No known exploits in the wild have been reported. The vendor recommends patching affected versions and upgrading to the latest long-term support release.

An attacker with administrative privileges can inject malicious code that executes in the browsers of other users, potentially leading to unauthorized actions or data exposure within the affected Portal for ArcGIS environment. The impact is limited to confidentiality and integrity with no availability impact. The attack requires high privileges and no user interaction is needed.

Users working with ArcGIS Enterprise versions 11.1, 11.3, and 11.5 should apply available patches or upgrade to the latest long-term support release as recommended by Esri. Since no patch links are provided in the input, users should consult the official Esri advisory or support channels for the latest remediation guidance. No indication is given that the vulnerability is already mitigated or requires no action.