CVE-2026-69235 describes a stored cross-site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and earlier. The flaw permits a remote attacker with privileges to inject malicious scripts that execute in the context of a victim's browser, potentially leading to limited confidentiality and integrity impacts. The vulnerability has a CVSS 3.1 base score of 6.1 (medium severity), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity. Specific affected versions include ArcGIS Enterprise 11.1, 11.3, and 11.5. Users are encouraged to patch or upgrade to the latest long-term support release. No known exploits in the wild have been reported, and no explicit patch links were provided in the source data.

Successful exploitation could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to limited disclosure or manipulation of information accessible to the user. The impact is limited to confidentiality and integrity with no availability impact. The attacker must have privileges and user interaction is required, reducing the likelihood of exploitation. No known active exploitation has been reported.

Users of Esri Portal for ArcGIS versions 11.5 and prior, including 11.1 and 11.3, should apply available patches or upgrade to the latest long-term support release as recommended by the vendor. Since no explicit patch links are provided, users should consult the official Esri support channels or advisories for the latest remediation guidance. No additional mitigations are specified in the advisory.