There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to… (CVE-2026-69238)
An HTML injection vulnerability exists in Esri Portal for ArcGIS versions 11.5 and prior. This flaw allows a remote attacker with high privileges to inject arbitrary HTML into the Portal for ArcGIS Home application. The vulnerability has a low severity rating and requires user interaction for exploitation. Users of ArcGIS Enterprise versions 11.1, 11.3, and 11.5 are advised to apply patches or upgrade to the latest long-term support release.
AI Analysis
Technical Summary
CVE-2026-69238 describes an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and earlier. A remote attacker with high privileges can insert arbitrary HTML content into the Portal for ArcGIS Home application, potentially impacting confidentiality and integrity. The vulnerability requires user interaction and has a low CVSS score of 3.5. No known exploits are reported in the wild. Users of affected versions 11.1, 11.3, and 11.5 are encouraged to patch or upgrade to mitigate this issue.
Potential Impact
The vulnerability allows a remote, highly privileged attacker to inject arbitrary HTML into the Portal for ArcGIS Home application, which could lead to limited confidentiality and integrity impacts. There is no reported impact on availability. Exploitation requires user interaction. No active exploitation in the wild is known.
Mitigation Recommendations
Users working with ArcGIS Enterprise versions 11.1, 11.3, and 11.5 should apply available patches or upgrade to the latest long-term support release. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the vendor advisory for current remediation guidance.
There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to… (CVE-2026-69238)
Description
An HTML injection vulnerability exists in Esri Portal for ArcGIS versions 11.5 and prior. This flaw allows a remote attacker with high privileges to inject arbitrary HTML into the Portal for ArcGIS Home application. The vulnerability has a low severity rating and requires user interaction for exploitation. Users of ArcGIS Enterprise versions 11.1, 11.3, and 11.5 are advised to apply patches or upgrade to the latest long-term support release.
CVSS v3.1
Score 3.5low
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-69238 describes an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and earlier. A remote attacker with high privileges can insert arbitrary HTML content into the Portal for ArcGIS Home application, potentially impacting confidentiality and integrity. The vulnerability requires user interaction and has a low CVSS score of 3.5. No known exploits are reported in the wild. Users of affected versions 11.1, 11.3, and 11.5 are encouraged to patch or upgrade to mitigate this issue.
Potential Impact
The vulnerability allows a remote, highly privileged attacker to inject arbitrary HTML into the Portal for ArcGIS Home application, which could lead to limited confidentiality and integrity impacts. There is no reported impact on availability. Exploitation requires user interaction. No active exploitation in the wild is known.
Mitigation Recommendations
Users working with ArcGIS Enterprise versions 11.1, 11.3, and 11.5 should apply available patches or upgrade to the latest long-term support release. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5v9j-3f6c-93pf
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-69238"]
- Ecosystems
- []
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a89a6dcacd9273b49151e8c
Added to database: 08/22/2026, 13:40:44 UTC
Last enriched: 08/22/2026, 13:46:06 UTC
Last updated: 08/22/2026, 16:51:58 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.