CVE-2026-69231: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Esri Portal for ArcGIS

This vulnerability (CVE-2026-69231) is a stored cross-site scripting (CWE-79) flaw in Esri Portal for ArcGIS. It affects versions from 11.1 up to and including 11.5. A remote attacker with privileged access can inject malicious scripts that execute arbitrary JavaScript in the context of other users' browsers, potentially leading to session hijacking or other client-side impacts. The CVSS 3.1 base score is 5.5 (medium), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and impact on confidentiality and integrity but not availability. No known exploits in the wild have been reported. The vendor recommends patching affected versions or upgrading to the latest long-term support release.

Successful exploitation allows a remote, privileged attacker to inject and execute arbitrary JavaScript in the browsers of other users interacting with the affected Portal for ArcGIS instance. This can lead to confidentiality and integrity impacts such as theft of sensitive information or manipulation of web content. Availability is not affected. The attack requires high privileges and no user interaction is needed.

Users running Esri Portal for ArcGIS versions 11.1, 11.3, or 11.5 should apply available patches or upgrade to the latest long-term support release as recommended by Esri. Since no explicit patch links are provided, users should consult the official Esri advisory or support channels for the appropriate updates. No indication exists that the vulnerability is already mitigated or requires no action.