CVE-2026-69238: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Esri Portal for ArcGIS

This vulnerability (CVE-2026-69238) is an improper neutralization of input during web page generation (CWE-79) in Esri Portal for ArcGIS. It permits a remote attacker with high privileges to inject arbitrary HTML content into the Portal for ArcGIS Home application, potentially impacting confidentiality and integrity. The affected versions are from 11.1 through 11.5 inclusive. The CVSS v3.1 base score is 3.5, indicating low severity, with attack vector network, low attack complexity, high privileges required, user interaction required, and impacts on confidentiality and integrity but not availability.

An attacker with high privileges can inject arbitrary HTML into the Portal for ArcGIS Home application, which may lead to limited confidentiality and integrity impacts such as information disclosure or manipulation of displayed content. The vulnerability does not affect availability and requires user interaction. The overall severity is low based on the CVSS score of 3.5.

Users working with ArcGIS Enterprise versions 11.1, 11.3, and 11.5 are encouraged to apply patches or upgrade to the latest long-term support release. Since no explicit patch links are provided, users should consult Esri's official advisories or support channels for the latest remediation guidance. No indication exists that the vulnerability is mitigated by default or that no action is required.