CVE-2026-69232 is a stored cross-site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior. It enables a remote attacker with privileged access to inject malicious scripts that execute arbitrary JavaScript in the browsers of other users. The vulnerability has a CVSS 3.1 base score of 5.5 (medium severity), with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts confidentiality and integrity. No known exploits are reported in the wild. The vendor recommends patching affected versions or upgrading to the latest long-term support release.

Successful exploitation could allow an attacker with privileged access to execute arbitrary JavaScript in other users' browsers, potentially leading to unauthorized actions or data exposure within the affected Portal for ArcGIS environment. The impact is limited to confidentiality and integrity, with no availability impact reported.

Users running Esri Portal for ArcGIS versions 11.1, 11.3, or 11.5 should apply available patches or upgrade to the latest long-term support release as recommended by the vendor. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the official Esri advisory for current remediation guidance.