This vulnerability is a stored cross-site scripting (CWE-79) issue in Esri Portal for ArcGIS, affecting versions 11.5 and earlier. It enables a remote attacker with administrative privileges to inject malicious scripts that execute in the context of other users' browsers. The flaw could lead to limited confidentiality and integrity impacts but does not affect availability. The vulnerability has a CVSS 3.1 base score of 5.5 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N). No official patch or remediation level is stated in the vendor advisory, and no known exploits are reported in the wild.

A remote attacker with administrative privileges can exploit this vulnerability to inject malicious scripts that execute in other users' browsers, potentially compromising confidentiality and integrity of user data within the affected Portal for ArcGIS environment. There is no impact on availability. The attack requires high privileges and no user interaction is needed for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users working with ArcGIS Enterprise versions 11.1, 11.3, and 11.5 are encouraged to apply patches when available or upgrade to the latest long-term support release. Until a patch is available, restrict administrative access to trusted personnel only to reduce risk.