CVE-2026-69235

Received Received - Intake

Stored XSS in Esri Portal for ArcGIS

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: Environmental Systems Research Institute, Inc.

Description

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-69235

Affected Vendors & Products

Vendor	Product	Version / Range
esri	portal_for_arcgis	to 11.6 (exc)
esri	arcgis_enterprise	to 11.1 (inc)
esri	arcgis_enterprise	to 11.3 (inc)
esri	arcgis_enterprise	to 11.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS versions 11.5 and earlier. It allows a remote, privileged attacker to inject malicious code that could execute arbitrary actions in a victim's browser.

Detection Guidance

Detection involves checking for XSS vulnerabilities in Esri Portal for ArcGIS versions 11.5 and prior. Review web application logs for suspicious script injections or unusual input patterns. Use tools like Burp Suite or OWASP ZAP to scan for stored XSS flaws. Ensure your web application firewall (WAF) is configured to block known XSS payloads.

Impact Analysis

An attacker could exploit this to run malicious scripts in your browser, potentially stealing session cookies, sensitive data, or performing actions on your behalf without your consent.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality.

Mitigation Strategies

Immediately upgrade to the latest long-term support release of ArcGIS Enterprise. If using versions 11.1, 11.3, or 11.5, apply the latest patches from Esri. Implement input validation and output encoding in your web applications. Restrict user privileges to minimize potential impact of an exploit.

Hi! I’m here to help you understand CVE-2026-69235. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70