CVE-2026-69232: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Esri Portal for ArcGIS

This vulnerability (CVE-2026-69232) is a stored cross-site scripting issue in Esri Portal for ArcGIS affecting versions 11.1 through 11.5. A remote attacker with privileged access can inject malicious scripts that execute arbitrary JavaScript in the context of other users' browsers. The vulnerability arises from improper neutralization of input during web page generation, classified under CWE-79. The CVSS 3.1 base score is 5.5, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required. The impact includes limited confidentiality and integrity loss but no availability impact.

An attacker with privileged access to the Portal for ArcGIS can inject malicious JavaScript code that executes in the browsers of other users, potentially leading to unauthorized actions or data exposure within the web application context. The confidentiality and integrity of affected users may be partially compromised. There is no indication of availability impact or active exploitation in the wild.

Users of Esri Portal for ArcGIS versions 11.1, 11.3, and 11.5 should apply available patches or upgrade to the latest long-term support release as recommended by Esri. Since no explicit patch links are provided in the input, users should consult the official Esri advisory or support channels for the latest remediation updates. No additional mitigation steps are indicated.