CVE-2026-69236: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Esri Portal for ArcGIS

This vulnerability is a stored cross-site scripting issue (CWE-79) in Esri Portal for ArcGIS, affecting versions 11.1 through 12.1 inclusive. It allows a remote attacker with privileges to inject malicious scripts into web pages generated by the portal, which can then execute arbitrary JavaScript in the context of other users' browsers. The CVSS 3.1 base score is 6.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity but not availability.

Successful exploitation could lead to the execution of arbitrary JavaScript in the victim's browser, potentially compromising user data confidentiality and integrity within the affected portal environment. There is no indication of known exploits in the wild. The impact is limited to confidentiality and integrity, with no availability impact reported.

Users of Esri Portal for ArcGIS versions 11.1 through 12.1 should upgrade to the latest long-term support release and apply the vendor-provided patch. Since no direct patch links are provided, users should consult Esri's official advisories or support channels for the patch. No indication exists that the vulnerability is already mitigated or requires no action.