Stored Cross-Site Scripting Vulnerability in Esri Portal for ArcGIS
CVE-2026-69231

5.5MEDIUM

Key Information:

Vendor

Esri

Status
Portal For Arcgis
Vendor
CVE Published:
21 August 2026

What is CVE-2026-69231?

A vulnerability in the Esri Portal for ArcGIS prior to version 11.5 allows remote, privileged attackers to exploit stored cross-site scripting (XSS) issues. An attacker can inject malicious JavaScript that may execute in the context of a user's browser, potentially compromising sensitive information or performing unauthorized actions. Users are urged to upgrade to the latest long-term support release or apply necessary patches to mitigate risks associated with this vulnerability.

Affected Version(s)

Portal for ArcGIS Windows 11.1 <= 11.5

References

https://www.esri.com/arcgis-blog/products/arcgis-enterpri...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.