Threat Intelligence Database

An information disclosure vulnerability exists in Esri Portal for ArcGIS versions 12.0 and earlier. Under difficult to reproduce conditions, a remote, unauthenticated attacker may be able to cause sensitive information to be reflected in an HTTP response body. The vulnerability has a moderate severity score and does not require authentication for exploitation. No known exploits are reported in the wild, and no patch or remediation information is currently available.

A stored cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 11.5 and earlier. This flaw allows a remote attacker with administrative privileges to inject malicious scripts that could execute in the browsers of other users. The vulnerability affects versions including 11.1, 11.3, and 11.5. Users are advised to upgrade to the latest long-term support release to mitigate the risk.

A stored cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 11.5 and prior. This vulnerability may allow a remote, privileged attacker to inject malicious JavaScript code that executes in the context of other users' browsers. The issue affects versions including 11.1, 11.3, and 11.5. Users are advised to patch or upgrade to the latest long-term support release to mitigate this risk.

A reflected cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 11.5 and earlier. This flaw allows a remote, unauthenticated attacker to craft a malicious link that, when clicked by a victim, may execute arbitrary JavaScript in the victim's browser. Users of ArcGIS Enterprise versions 11.1, 11.3, and 11.5 are advised to apply patches or upgrade to the latest long-term support release. Additionally, users of ArcGIS Web App Builder developer edition should migrate to ArcGIS Experience Builder as the former is unsupported for this vulnerability.

A stored cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 11.5 and prior. This vulnerability allows a remote, privileged attacker to inject malicious code that may execute in the browser of a victim. Users of ArcGIS Enterprise versions 11.1, 11.3, and 11.5 are specifically advised to apply patches or upgrade to the latest long-term support release to mitigate this issue.

CVE-2026-69235 is a stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.5 and earlier. It allows a remote, privileged attacker to inject malicious code that could execute in the browser of a victim. The vulnerability affects versions 11.1, 11.3, and 11.5 specifically. Users are advised to patch or upgrade to the latest long-term support release to mitigate the risk.

CVE-2026-69236 is a stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 through 12.1. This flaw allows a remote, privileged attacker to inject malicious JavaScript code that could execute in the browsers of other users. The vulnerability affects multiple versions of ArcGIS Enterprise, and users are advised to upgrade to the latest long-term support release and apply the patch.

CVE-2026-69232 is a stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 through 11.5. It allows a remote, privileged attacker to inject malicious JavaScript code that could execute in the browsers of users interacting with the affected portal. This vulnerability has a medium severity rating with a CVSS score of 5.5. Users of ArcGIS Enterprise versions 11.1, 11.3, and 11.5 are advised to apply patches or upgrade to the latest long-term support release to mitigate the risk.

CVE-2026-69231 is a stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.5 and earlier. It allows a remote, privileged attacker to inject malicious JavaScript code that could execute in the browsers of other users. The vulnerability affects versions 11.1 through 11.5, with a medium severity rating and a CVSS score of 5.5. Users of ArcGIS Enterprise 11.1, 11.3, and 11.5 are advised to apply patches or upgrade to the latest long-term support release to mitigate the risk.

CVE-2026-69230 is a stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.5 and earlier. It allows a remote attacker with administrative privileges to inject malicious code that could execute in the browsers of other users. The vulnerability affects versions from 11.1 through 11.5. Users of ArcGIS Enterprise 11.1, 11.3, and 11.5 are advised to apply patches or upgrade to the latest long-term support release.