CVE-2026-69233: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Esri Portal for ArcGIS

This vulnerability is a stored cross-site scripting issue (CWE-79) in Esri Portal for ArcGIS versions 11.1 through 11.5. An attacker with administrative privileges can inject malicious scripts that execute in the context of other users' browsers, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 5.5 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

The vulnerability allows an attacker with administrative privileges to execute arbitrary scripts in the browsers of other users, potentially compromising user sessions or exposing sensitive information. The impact is limited to confidentiality and integrity, with no direct availability impact. There are no known exploits in the wild at this time.

Users of Esri Portal for ArcGIS versions 11.1, 11.3, and 11.5 are encouraged to upgrade to the latest long-term support release to remediate this vulnerability. No official patch links were provided, so checking the vendor's advisory for the latest updates and applying the recommended upgrade is advised.