CVE-2025-57875: Esri Portal for ArcGIS XSS Vulnerability

CVE-2025-57875 Overview

CVE-2025-57875 is a reflected cross-site scripting (XSS) vulnerability affecting Esri Portal for ArcGIS versions 11.4 and below. A remote authenticated attacker with administrative access can supply a crafted string that causes arbitrary JavaScript to execute in a victim's browser session. The flaw is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Exploitation requires both administrative privileges and user interaction, which limits the attacker population. However, the scope change component means executed script can affect resources beyond the vulnerable component's security boundary.

Critical Impact
An authenticated administrator with malicious intent, or an administrator whose session is coerced into visiting a crafted URL, can execute arbitrary JavaScript in another user's browser context within the ArcGIS Portal.

Affected Products

Esri Portal for ArcGIS 10.9.1 (including Security 2025 Update 1 and Update 2)
Esri Portal for ArcGIS 11.0, 11.1, 11.2, 11.3 (all sub-releases including 2024 and 2025 security updates)
Esri Portal for ArcGIS 11.4 (including Security 2025 Update 1 and Update 2)

Discovery Timeline

2025-09-29 - CVE-2025-57875 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57875

Vulnerability Analysis

CVE-2025-57875 is a reflected XSS vulnerability in the web interface of Esri Portal for ArcGIS. Reflected XSS occurs when a web application returns user-supplied input in an HTTP response without proper output encoding or sanitization. The browser then interprets the reflected content as executable script.

Because the attack vector is network-based and the impact scope is changed, injected JavaScript can affect the browser's Document Object Model (DOM) beyond the immediate vulnerable component. Confidentiality and integrity are rated as low impact, while availability is unaffected.

The requirement for high privileges (administrative access) and user interaction narrows practical exploitation. A malicious administrator, an administrator whose account was compromised, or an administrator socially engineered into clicking a crafted link is the typical exploitation scenario.

Root Cause

The root cause is improper neutralization of user-controlled input in a server response. When an administrative endpoint reflects a crafted parameter value back into an HTML response without contextual output encoding, JavaScript embedded in that value is executed by the browser rendering the page.

Attack Vector

Exploitation follows the classic reflected XSS pattern. An attacker crafts a URL that targets the vulnerable Portal endpoint and embeds JavaScript payload data in a request parameter. The attacker then delivers the URL to a Portal administrator using phishing, chat, or another social channel. When the administrator opens the URL while authenticated, the payload executes in their browser with the Portal origin's privileges.

Executed script can perform actions such as reading session data, issuing authenticated requests to the Portal API on behalf of the victim, harvesting displayed information, or manipulating the rendered UI. Refer to the Esri Portal for ArcGIS Security 2025 Update 3 advisory for vendor technical details.

Detection Methods for CVE-2025-57875

Indicators of Compromise

HTTP request logs to Portal for ArcGIS endpoints containing URL-encoded <script>, onerror=, onload=, or javascript: tokens in query string parameters.
Referrer headers on administrator sessions originating from external or unexpected domains such as email link trackers or messaging platforms.
Unusual authenticated API calls from administrator sessions immediately following a page load that included suspicious query parameters.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query parameters sent to Portal for ArcGIS for common XSS payload patterns.
Enable and centralize Portal access logs, then hunt for reflected parameters containing HTML or JavaScript syntax across administrative URLs.
Correlate administrator login events with subsequent API calls to detect script-driven activity that deviates from typical administrator workflows.

Monitoring Recommendations

Monitor Content Security Policy (CSP) violation reports if CSP is deployed in front of Portal for ArcGIS.
Alert on administrator sessions that generate large volumes of API calls in short windows, which can indicate scripted activity.
Review browser and endpoint telemetry for administrators visiting Portal URLs referred from external chat or webmail domains.

How to Mitigate CVE-2025-57875

Immediate Actions Required

Apply the Esri Portal for ArcGIS Security 2025 Update 3 patch to all affected deployments as documented in the vendor advisory.
Restrict administrative access to Portal for ArcGIS to a defined set of trusted network locations using firewall or reverse-proxy allowlists.
Enforce multi-factor authentication on all Portal for ArcGIS administrator accounts to reduce risk from credential compromise.
Instruct administrators to avoid clicking Portal URLs delivered through email, chat, or other external channels without verification.

Patch Information

Esri has released Portal for ArcGIS Security 2025 Update 3 to address CVE-2025-57875. Upgrade guidance and download details are available in the Esri Security 2025 Update 3 advisory. Deployments running versions 10.9.1 through 11.4 with any of the earlier 2024 or 2025 security updates remain vulnerable until Update 3 is applied.

Workarounds

Restrict Portal administrative endpoints to a dedicated management network or VPN segment while patching is scheduled.
Deploy a strict Content Security Policy at the reverse proxy layer to limit the impact of reflected script execution.
Configure WAF signatures to block requests to Portal for ArcGIS that contain typical XSS payload patterns in query parameters.
Review administrator accounts and remove any that are no longer required to shrink the exploitable population.

bash

# Example WAF rule pattern (ModSecurity syntax) to block reflected XSS payloads
# targeting Portal for ArcGIS query parameters. Test in DetectionOnly mode first.
SecRule REQUEST_URI "@contains /arcgis/" \
  "chain,id:1057875,phase:2,deny,status:400,msg:'CVE-2025-57875 XSS payload'"
SecRule ARGS "@rx (?i)(<script|onerror\s*=|onload\s*=|javascript:)" \
  "t:none,t:urlDecodeUni"