CVE-2026-69229: Esri Portal for ArcGIS XSS Vulnerability

CVE-2026-69229 Overview

CVE-2026-69229 is an HTML injection vulnerability affecting Esri Portal for ArcGIS versions 12.0 and prior. A remote, authenticated attacker can inject arbitrary HTML into the Portal for ArcGIS Home application. The flaw is classified under CWE-79, which covers improper neutralization of input during web page generation. Esri recommends that users running ArcGIS Enterprise 11.1, 11.3, 11.5, and 12.0 apply the vendor patch and upgrade to the current long-term support release.

Critical Impact
Authenticated attackers can inject arbitrary HTML into the Portal Home application, enabling content spoofing and phishing against other Portal users.

Affected Products

Esri Portal for ArcGIS 12.0 and prior
ArcGIS Enterprise 11.1, 11.3, 11.5
ArcGIS Enterprise 12.0

Discovery Timeline

2026-08-21 - CVE-2026-69229 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-69229

Vulnerability Analysis

The vulnerability exists in the Portal for ArcGIS Home application, the web-based front-end used to browse content, manage items, and access administrative functions. Portal fails to properly neutralize HTML markup submitted through fields rendered back to other users. An authenticated attacker with a valid Portal account can supply crafted HTML that the application stores and later renders in another user's browser session.

Because the injection occurs in an authenticated portion of the application, exploitation requires valid credentials. The impact is limited to content injection rather than script execution with full session takeover, which aligns with the low confidentiality and low integrity impact assigned by the vendor.

Root Cause

The root cause is missing or incomplete output encoding when Portal renders user-supplied fields in the Home application. Untrusted input reaches the HTML rendering context without being escaped, allowing tag injection. This is a textbook instance of CWE-79 applied to a stored HTML injection sink.

Attack Vector

An attacker authenticates to the target Portal for ArcGIS instance, then submits HTML payloads through an input field that is later displayed to other Portal users. When a victim loads the affected view in the Home application, the injected markup renders in their browser. Attackers can use this to create spoofed login prompts, misleading notices, or fraudulent links that appear to originate from the trusted Portal domain.

No verified public exploit code is available. See the Esri ArcGIS Security Bulletin August 2026 for vendor technical details.

Detection Methods for CVE-2026-69229

Indicators of Compromise

Portal item metadata, group descriptions, or profile fields containing unexpected HTML tags such as <iframe>, <form>, <a href>, or <img> referencing external hosts.
Portal audit log entries showing content edits or item creation from low-privilege user accounts immediately preceding user reports of anomalous Home page content.
Outbound HTTP requests from Portal user browsers to domains not associated with the ArcGIS deployment shortly after loading Portal Home views.

Detection Strategies

Inspect stored Portal content fields for embedded HTML markup by querying the Portal content store for tag characters in user-editable string fields.
Correlate Portal for ArcGIS access logs with browser-side content security policy (CSP) violation reports to surface injected markup at render time.
Baseline legitimate Portal item content and alert on deviations that introduce hyperlinks or embedded objects pointing to external domains.

Monitoring Recommendations

Forward Portal for ArcGIS application logs and web server access logs to a centralized analytics platform for retention and query.
Monitor authenticated account activity for accounts creating or editing multiple Portal items in a short window, particularly newly provisioned accounts.
Track user reports of unexpected prompts, redirects, or visual changes within the Portal Home interface as an early indicator of content injection.

How to Mitigate CVE-2026-69229

Immediate Actions Required

Apply the security patches referenced in the Esri ArcGIS Security Bulletin August 2026 to all affected ArcGIS Enterprise deployments.
Upgrade Portal for ArcGIS to the current long-term support release as recommended by Esri.
Audit Portal user accounts and remove or disable accounts that are no longer required, reducing the pool of potential authenticated attackers.
Review existing Portal items, groups, and user profiles for injected HTML introduced prior to patching.

Patch Information

Esri released fixes as part of the August 2026 ArcGIS Security Bulletin. Administrators running ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 should install the corresponding Portal for ArcGIS security patch or upgrade to the latest long-term support release. Refer to the Esri ArcGIS Security Bulletin August 2026 for exact patch identifiers and installation guidance.

Workarounds

Restrict Portal account creation and limit content-authoring privileges to trusted users until the patch is deployed.
Enforce a strict Content Security Policy at the reverse proxy or load balancer fronting Portal for ArcGIS to constrain rendering of injected markup.
Educate Portal users to report unexpected forms, login prompts, or external links appearing within the Portal Home application.

bash

# Example: enforce a restrictive CSP header at an nginx reverse proxy in front of Portal
add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self'; form-action 'self'; object-src 'none'" always;