The vulnerability identified as CVE-2026-69234 is a reflected cross-site scripting (CWE-79) issue affecting Esri Portal for ArcGIS versions 11.5 and prior. It permits remote, unauthenticated attackers to generate crafted URLs that execute arbitrary JavaScript code in the context of a victim's browser upon clicking. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. The vulnerability affects ArcGIS Enterprise versions 11.1, 11.3, and 11.5, and also impacts ArcGIS Web App Builder developer edition, which is unsupported for this CVE. Users are encouraged to patch or upgrade to the latest long-term support release and migrate from unsupported components.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to information disclosure or manipulation of user interactions within the affected application context. The vulnerability requires user interaction (clicking a crafted link) and does not grant direct system access or availability disruption. The impact is limited to confidentiality and integrity at a low level.

Users of ArcGIS Enterprise versions 11.1, 11.3, and 11.5 should apply available patches or upgrade to the latest long-term support release as recommended by Esri. Users of ArcGIS Web App Builder developer edition should migrate to ArcGIS Experience Builder since the former is unsupported for this vulnerability. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the official Esri advisory for current remediation guidance.