This vulnerability (CVE-2026-69235) is a stored cross-site scripting flaw (CWE-79) in Esri Portal for ArcGIS. It affects versions 11.5 and earlier, including specifically version 11.1. The flaw allows a remote attacker with privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no availability impact. No official patch or remediation level is stated in the vendor data, and no known exploits are reported in the wild.

Successful exploitation could allow a remote, privileged attacker to execute arbitrary scripts in the browsers of other users interacting with the Portal for ArcGIS, potentially leading to information disclosure or manipulation of user sessions. The impact is limited to confidentiality and integrity with no availability impact. The medium CVSS score reflects these factors.

No official patch or remediation level is currently confirmed. Users working with ArcGIS Enterprise versions 11.1, 11.3, and 11.5 are encouraged to upgrade to the latest long-term support release as a mitigation measure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.