HTML Injection Vulnerability in Esri Portal for ArcGIS

CVE-2026-69238

What is CVE-2026-69238?

An HTML injection vulnerability exists in Esri Portal for ArcGIS versions 11.5 and earlier, which may allow a remote attacker with elevated privileges to embed malicious HTML code within the application's Home interface. This could lead to potential exploitation of the application and expose users to security risks. To mitigate this issue, users running affected versions, specifically ArcGIS Enterprise 11.1, 11.3, and 11.5, should implement patches immediately. All users are strongly encouraged to upgrade to the latest long-term support release to ensure security.

References