Reflected Cross Site Scripting Vulnerability in Esri Portal for ArcGIS
CVE-2026-50096

6.1MEDIUM

Key Information:

Vendor

Esri

Status
Arcgis Server
Vendor
CVE Published:
26 October 2026

What is CVE-2026-50096?

A reflected cross site scripting vulnerability exists in Esri Portal for ArcGIS that could enable remote, unauthenticated attackers to craft malicious links. When clicked, these links may execute arbitrary JavaScript code in the browser of unsuspecting users. The affected versions include Esri Portal for ArcGIS 12.1 and prior. Esri has provided a patch applicable to versions 12.1, 12.0, 11.5, 11.3, and 11.1, while users with unlisted versions are strongly advised to upgrade to ensure their systems are protected.

Affected Version(s)

ArcGIS Server Windows 11.1 < 12.1

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/ad...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.