There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged… (CVE-2026-69230)

A stored cross-site scripting vulnerability (CWE-79) exists in Esri Portal for ArcGIS versions up to and including 11.5. An attacker with remote administrative privileges can inject malicious scripts that execute in the browsers of portal users. The CVSS 3.1 base score is 5.5 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality and integrity with no availability impact. The vulnerability affects versions <=11.5. No known exploits in the wild have been reported.

Successful exploitation allows an attacker with administrative privileges to inject malicious scripts that execute in the context of other users' browsers, potentially exposing sensitive information or altering data viewed by those users. The impact is limited to confidentiality and integrity, with no availability impact reported.

Users running Esri Portal for ArcGIS versions 11.1, 11.3, and 11.5 should apply available patches or upgrade to the latest long-term support release. Since no explicit patch links or vendor advisory details are provided, users should consult Esri's official resources for the latest updates and remediation instructions. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.