CVE-2026-69230 Overview
CVE-2026-69230 is a stored cross-site scripting (XSS) vulnerability affecting Esri Portal for ArcGIS versions 11.5 and prior. An attacker with administrative privileges can inject malicious script content that persists in the application and executes in a victim's browser session. The flaw is categorized under [CWE-79], improper neutralization of input during web page generation. Esri published guidance in the August 2026 ArcGIS Security Bulletin urging users of ArcGIS Enterprise 11.1, 11.3, and 11.5 to apply the available patches, and recommending all deployments upgrade to the latest long-term support release.
Critical Impact
A remote, authenticated administrator can persist attacker-controlled JavaScript in Portal for ArcGIS, executing arbitrary code in the browsers of other Portal users.
Affected Products
- Esri Portal for ArcGIS 11.5
- Esri Portal for ArcGIS 11.3
- Esri Portal for ArcGIS 11.1 and prior 11.x releases
Discovery Timeline
- 2026-08-21 - CVE-2026-69230 published to the National Vulnerability Database
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-69230
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw in Portal for ArcGIS, the web-facing component of ArcGIS Enterprise used to publish and manage geospatial content. Portal accepts administrator-supplied content into fields that are later rendered to other users without sufficient output encoding or input sanitization. When a subsequent user loads the affected page, the injected payload runs in the context of their authenticated Portal session. Because the payload executes in the browser, an attacker can read page content accessible to the victim, issue authenticated requests on their behalf, and interact with Portal APIs using the victim's privileges. The advisory notes a scope change, indicating that impact extends beyond the vulnerable component to other trust boundaries in the browser session.
Root Cause
The root cause is improper neutralization of user-controlled input rendered in Portal for ArcGIS web pages. Administrator input paths do not consistently apply contextual output encoding, so HTML or JavaScript submitted through affected fields is stored verbatim and later served to other users. Administrative privilege is required to reach the vulnerable input path, which limits the attacker population but does not prevent post-authentication abuse of stolen or misused admin credentials.
Attack Vector
Exploitation requires network access to Portal for ArcGIS and valid administrative credentials. The attacker submits a payload containing script content through an administrative interface that stores the value. When any user, including higher-trust operators or other administrators, visits a page that renders the stored content, the script executes automatically. No additional user interaction beyond normal navigation is required. The AV:N/PR:H/UI:N/S:C characteristics reflect this remote, authenticated, no-interaction stored XSS pattern with cross-scope impact.
No public proof-of-concept code has been released. Technical details are described in the ESRI ArcGIS Security Bulletin.
Detection Methods for CVE-2026-69230
Indicators of Compromise
- Portal for ArcGIS items, groups, or profile fields containing <script>, javascript:, onerror=, onload=, or other HTML event handler attributes.
- Unexpected outbound requests from Portal user browsers to attacker-controlled hosts shortly after loading Portal content pages.
- Administrative modifications to shared items, banners, or descriptions from accounts that do not normally perform content edits.
Detection Strategies
- Query Portal item metadata and description fields for HTML tags and JavaScript URI schemes to identify stored payloads.
- Review Portal for ArcGIS web server logs for POST requests to item, group, and profile update endpoints originating from administrative sessions.
- Correlate administrator login events with subsequent content-modification events to surface anomalous editing patterns.
Monitoring Recommendations
- Enable and forward Portal for ArcGIS access and audit logs to a centralized logging platform for retention and analysis.
- Alert on script-like content submitted to Portal APIs and on administrator sessions initiated from unusual source addresses or geographies.
- Monitor browser-side telemetry from managed endpoints for anomalous script execution or DOM changes on Portal domains.
How to Mitigate CVE-2026-69230
Immediate Actions Required
- Apply the Esri security patches for ArcGIS Enterprise 11.1, 11.3, and 11.5 as directed in the August 2026 ArcGIS Security Bulletin.
- Plan an upgrade path to the latest ArcGIS Enterprise long-term support release for deployments on unsupported 11.x versions.
- Audit Portal administrator accounts, revoke unused privileges, and enforce multi-factor authentication on all administrative logins.
- Inspect existing Portal content, group descriptions, and profile fields for previously injected script payloads and remove them.
Patch Information
Esri has released patches addressing CVE-2026-69230 for ArcGIS Enterprise 11.1, 11.3, and 11.5. Refer to the ESRI ArcGIS Security Bulletin for the specific patch identifiers, downloads, and installation instructions applicable to each supported release.
Workarounds
- Restrict Portal administrative access to a small, well-defined group and require jump-host or VPN access for administrative sessions.
- Configure a Content Security Policy at the reverse proxy or load balancer in front of Portal to constrain inline script execution where feasible.
- Rotate administrator credentials and invalidate active Portal sessions after applying patches to remove any lingering attacker access.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
