CVE-2025-57874: Esri Portal For ArcGIS XSS Vulnerability

CVE-2025-57874 Overview

CVE-2025-57874 is a reflected cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS version 11.4 and earlier. A remote authenticated attacker with administrative access can supply a crafted string that causes arbitrary JavaScript to execute in a victim's browser. The flaw is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Esri published a fix in the Portal for ArcGIS Security 2025 Update 3 Patch. Exploitation requires administrative privileges plus user interaction, which limits practical attack scenarios, but a successful attack crosses a security scope boundary and can impact other users of the portal.

Critical Impact
Successful exploitation allows execution of attacker-controlled JavaScript in the browser context of a Portal for ArcGIS user, enabling session abuse and UI manipulation.

Affected Products

Esri Portal for ArcGIS 10.9.1 (including Security 2025 Update 1 and Update 2)
Esri Portal for ArcGIS 11.0, 11.1, 11.2, 11.3 (including Security 2024/2025 updates)
Esri Portal for ArcGIS 11.4 (including Security 2025 Update 1 and Update 2)

Discovery Timeline

2025-09-29 - CVE CVE-2025-57874 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57874

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the web interface of Esri Portal for ArcGIS. User-supplied input is returned in a server response without sufficient output encoding or sanitization. When the response renders in a browser, the attacker-controlled payload executes as JavaScript in the portal's origin.

Because the scope metric is Changed, the injected script can affect resources beyond the vulnerable component. In practical terms, a crafted link clicked by a portal user can run script within the portal domain and manipulate data the victim can access.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. A parameter processed by the portal is reflected into HTML or JavaScript context without encoding. Any string containing active markup is interpreted by the rendering browser rather than treated as inert text.

Attack Vector

Exploitation requires an authenticated administrator to deliver a crafted URL to a target user, who must then interact with the link. The attacker builds a request containing a JavaScript payload in a reflected parameter. When the target loads the response, the browser executes the payload within the portal context, enabling actions such as reading displayed content, performing requests on behalf of the user, or altering the rendered UI.

No verified public exploit or proof-of-concept has been published. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-57874

Indicators of Compromise

Portal access logs containing HTTP requests with URL parameters that include <script>, javascript:, onerror=, onload=, or URL-encoded equivalents such as %3Cscript%3E.
Referrer headers pointing to external or unexpected domains preceding administrator-targeted portal requests.
Browser console or Content Security Policy violation reports originating from the Portal for ArcGIS domain.

Detection Strategies

Inspect web server and reverse proxy logs for query strings containing HTML tags, event handlers, or encoded script fragments directed at Portal for ArcGIS endpoints.
Deploy web application firewall (WAF) rules that identify reflected XSS payload patterns in requests to /portal/ and /arcgis/ paths.
Correlate administrative session activity with anomalous outbound requests from administrator browsers immediately after accessing crafted URLs.

Monitoring Recommendations

Enable verbose request logging on Portal for ArcGIS and forward logs to a centralized analytics platform for retention and query.
Monitor for new or modified portal items, shared content, and user role changes performed by administrator accounts shortly after suspicious URL access.
Alert on Content Security Policy violation reports from the portal domain to surface unexpected inline script execution.

How to Mitigate CVE-2025-57874

Immediate Actions Required

Apply the Portal for ArcGIS Security 2025 Update 3 Patch to all affected deployments as published by Esri.
Audit administrator accounts, enforce strong authentication, and remove unused administrative privileges to reduce the attacker population capable of exploitation.
Instruct administrators to avoid clicking portal URLs received from untrusted sources until patching is complete.

Patch Information

Esri released a fix in the Portal for ArcGIS Security 2025 Update 3 Patch. Installation details and version coverage are documented in the Esri Portal for ArcGIS Security Patch advisory.

Workarounds

Restrict administrative portal access to a trusted management network or VPN to limit exposure of the vulnerable interface.
Deploy WAF rules that strip or block requests containing script tags, event handlers, and known reflected XSS patterns targeting Portal for ArcGIS endpoints.
Configure or enforce a strict Content Security Policy at the reverse proxy layer to reduce the impact of inline script execution.

bash

# Example WAF rule concept (ModSecurity) to block reflected XSS patterns
# against Portal for ArcGIS endpoints
SecRule REQUEST_URI "@beginsWith /portal/" \
  "id:1057874,phase:2,deny,status:403,\
   msg:'Potential reflected XSS targeting Portal for ArcGIS (CVE-2025-57874)',\
   chain"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
    "t:none,t:urlDecodeUni"