CVE-2026-69237: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Esri Portal for ArcGIS

This vulnerability (CVE-2026-69237) involves improper neutralization of input during web page generation in Esri Portal for ArcGIS, specifically versions 11.1 through 11.3. An attacker with administrative privileges can perform HTML injection via an administrative API, potentially affecting confidentiality and integrity. The CVSS 3.1 base score is 3.8 (low severity), reflecting network attack vector, low complexity, high privileges required, no user interaction, and limited impact on confidentiality and integrity. No known exploits are reported in the wild. The vendor recommends patching affected versions and upgrading to the latest long-term support release.

The vulnerability allows an attacker with administrative privileges to inject arbitrary HTML into the administrative API, which may lead to limited confidentiality and integrity impacts. There is no impact on availability. The attack requires high privileges and no user interaction is needed. No known active exploitation has been reported.

Users running Esri Portal for ArcGIS versions 11.1 through 11.3 should apply available patches or upgrade to the latest long-term support release as recommended by Esri. Since this is a vulnerability requiring administrative privileges, limiting administrative access and following vendor guidance is advised. Patch status is not explicitly stated; check Esri's official advisory for current remediation details.