CVE-2026-69236 is a stored cross-site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior. It enables a remote attacker with privileges to inject malicious JavaScript code that executes in the context of other users' browsers, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.1 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, no impact on availability. The vulnerability affects versions 11.1, 11.3, 11.5, 12.0, and 12.1. Users should upgrade to the latest long-term support release and apply patches as recommended by Esri.

Successful exploitation allows a remote, privileged attacker to execute arbitrary JavaScript in the victim's browser, which could lead to information disclosure or manipulation of user sessions. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction and privileges on the system to exploit.

Users should upgrade to the latest long-term support release of Esri Portal for ArcGIS and apply any available patches. Since no explicit patch links or vendor advisory are provided, patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until patched, limit exposure by restricting privileges and user interactions where possible.