CVE-2026-69234: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Esri Portal for ArcGIS

This vulnerability (CVE-2026-69234) is a reflected XSS issue in Esri Portal for ArcGIS versions 11.1 to 11.5. It arises from improper neutralization of input during web page generation (CWE-79). An attacker can create a crafted URL that executes arbitrary JavaScript in the context of the victim's browser upon clicking. The vulnerability requires user interaction (clicking the malicious link) and does not require authentication. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to theft of sensitive information or session hijacking within the context of the Portal for ArcGIS web application. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction and does not require authentication.

Users running Portal for ArcGIS versions 11.1 through 11.5 are encouraged to apply available patches or upgrade to the latest long-term support release. Since no explicit patch links are provided, users should consult Esri's official advisories for patch availability. Users of ArcGIS Web App Builder developer edition should migrate to ArcGIS Experience Builder, as the former is unsupported in relation to this vulnerability. No indication of no-action or automatic mitigation is provided, so remediation is recommended.