There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative… (CVE-2026-69237)
An HTML injection vulnerability exists in Esri Portal for ArcGIS versions 11.3 and earlier. This flaw allows a remote attacker with administrative privileges to inject arbitrary HTML into an administrative API. The vulnerability has a low severity score and does not require user interaction to exploit. Users of ArcGIS Enterprise versions 11.1 and 11.3 are advised to patch or upgrade to the latest long-term support release.
AI Analysis
Technical Summary
CVE-2026-69237 is an HTML injection vulnerability affecting Esri Portal for ArcGIS versions 11.3 and prior. It permits a remote attacker who already has administrative privileges to insert arbitrary HTML content into an administrative API endpoint. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score is 3.8 (low), reflecting limited impact on confidentiality and integrity and no impact on availability. No known exploits are reported in the wild. The vulnerability affects versions up to and including 11.3, with users encouraged to patch or upgrade to the latest long-term support release.
Potential Impact
The vulnerability allows an attacker with administrative privileges to inject arbitrary HTML code into an administrative API, potentially leading to limited confidentiality and integrity impacts. There is no impact on availability. Because administrative privileges are required, the risk is limited to users who already have high-level access.
Mitigation Recommendations
Users of ArcGIS Enterprise versions 11.1 and 11.3 should apply available patches or upgrade to the latest long-term support release. Since no specific patch links are provided, users should consult Esri's official advisories for remediation guidance. No additional mitigation is indicated.
There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative… (CVE-2026-69237)
Description
An HTML injection vulnerability exists in Esri Portal for ArcGIS versions 11.3 and earlier. This flaw allows a remote attacker with administrative privileges to inject arbitrary HTML into an administrative API. The vulnerability has a low severity score and does not require user interaction to exploit. Users of ArcGIS Enterprise versions 11.1 and 11.3 are advised to patch or upgrade to the latest long-term support release.
CVSS v3.1
Score 3.8low
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-69237 is an HTML injection vulnerability affecting Esri Portal for ArcGIS versions 11.3 and prior. It permits a remote attacker who already has administrative privileges to insert arbitrary HTML content into an administrative API endpoint. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score is 3.8 (low), reflecting limited impact on confidentiality and integrity and no impact on availability. No known exploits are reported in the wild. The vulnerability affects versions up to and including 11.3, with users encouraged to patch or upgrade to the latest long-term support release.
Potential Impact
The vulnerability allows an attacker with administrative privileges to inject arbitrary HTML code into an administrative API, potentially leading to limited confidentiality and integrity impacts. There is no impact on availability. Because administrative privileges are required, the risk is limited to users who already have high-level access.
Mitigation Recommendations
Users of ArcGIS Enterprise versions 11.1 and 11.3 should apply available patches or upgrade to the latest long-term support release. Since no specific patch links are provided, users should consult Esri's official advisories for remediation guidance. No additional mitigation is indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-m7mf-cx6j-4wpj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-69237"]
- Ecosystems
- []
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a89a6dcacd9273b49151e7c
Added to database: 08/22/2026, 13:40:44 UTC
Last enriched: 08/22/2026, 13:45:08 UTC
Last updated: 08/23/2026, 02:51:58 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.