Reflected Cross-Site Scripting in Esri Portal for ArcGIS Software
CVE-2026-33520

6.1MEDIUM

Key Information:

Vendor

Esri

Status
Arcgis Server
Vendor
CVE Published:
26 October 2026

What is CVE-2026-33520?

A reflected cross-site scripting vulnerability exists in Esri Portal for ArcGIS versions 12.1 and earlier. This flaw allows remote, unauthenticated attackers to craft malicious links that can execute arbitrary JavaScript code in the browser of a victim who clicks on the link. Users of the impacted versions are strongly encouraged to apply the provided patch to mitigate potential exploitation. It's important to upgrade to supported versions as those not listed may not receive patches.

Affected Version(s)

ArcGIS Server Windows 11.1 < 12.1

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/ad...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.