CVE-2026-69235: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Esri Portal for ArcGIS

This vulnerability is a stored cross-site scripting issue (CWE-79) in Esri Portal for ArcGIS, affecting versions 11.1 through 11.5. A remote attacker with privileges can inject malicious script code that executes in the context of a victim's browser, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, but user interaction needed, and impacts confidentiality and integrity with no availability impact.

An attacker with remote access and privileges can inject malicious scripts that execute in users' browsers, potentially compromising user data confidentiality and integrity. There is no direct impact on system availability. The vulnerability requires user interaction to trigger the malicious code execution.

Users of ArcGIS Enterprise versions 11.1, 11.3, and 11.5 are encouraged to apply patches or upgrade to the latest long-term support release. Since no explicit patch links are provided, users should consult Esri's official advisories for the latest remediation steps. No indication that the vulnerability is mitigated or requires no action.