CVE-2026-69234: Esri Portal for ArcGIS XSS Vulnerability

CVE-2026-69234 Overview

CVE-2026-69234 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in Esri Portal for ArcGIS versions 11.5 and prior. A remote, unauthenticated attacker can craft a malicious link that executes arbitrary JavaScript in a victim's browser when clicked. Exploitation requires user interaction, and the attack succeeds within the security context of the targeted Portal for ArcGIS session.

Esri has issued patches for ArcGIS Enterprise 11.1, 11.3, and 11.5. Users of ArcGIS Web App Builder developer edition, which is unsupported as of this advisory, are directed to migrate to ArcGIS Experience Builder.

Critical Impact
A crafted link can execute attacker-controlled JavaScript in an authenticated Portal for ArcGIS user's browser, enabling session token theft, UI manipulation, and phishing against enterprise GIS users.

Affected Products

Esri Portal for ArcGIS 11.5 and prior
ArcGIS Enterprise 11.1, 11.3, and 11.5
ArcGIS Web App Builder developer edition (unsupported; migration required)

Discovery Timeline

2026-08-21 - CVE-2026-69234 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-69234

Vulnerability Analysis

The flaw is a reflected XSS issue in Esri Portal for ArcGIS. Reflected XSS occurs when server-side code echoes attacker-controlled input from a request back into an HTTP response without adequate output encoding or input sanitization. When a victim clicks a crafted link, the payload executes in the victim's browser under the origin of the Portal for ArcGIS instance.

Because Portal for ArcGIS underpins ArcGIS Enterprise deployments, executed script can access session cookies, invoke Portal REST endpoints on behalf of the user, and read map, layer, or organizational data the user is authorized to access. The scope change indicated by the CVSS vector reflects impact that extends beyond the vulnerable component into the user's authenticated browsing session.

Root Cause

The root cause is insufficient neutralization of user-supplied input during web page generation [CWE-79]. Input reflected into the response is not encoded contextually for HTML, attribute, or JavaScript contexts, allowing an attacker to break out of the intended data context and inject executable script.

Attack Vector

Exploitation is network-based and requires no authentication, but relies on user interaction. An attacker crafts a URL that includes a JavaScript payload in a reflected parameter and delivers the link through phishing, social media, or an embedded reference on a third-party site. When an authenticated ArcGIS Enterprise user follows the link, the browser executes the payload against the Portal origin.

Refer to the Esri ArcGIS Security Bulletin for vendor-provided technical details.

// No verified proof-of-concept code is publicly available for CVE-2026-69234.
// See the Esri ArcGIS Security Bulletin for vendor guidance.

Detection Methods for CVE-2026-69234

Indicators of Compromise

Portal for ArcGIS access logs containing request parameters with HTML tags, javascript: URIs, or encoded <script> fragments.
Referer headers pointing to untrusted third-party domains preceding authenticated Portal activity.
Unexpected outbound requests from user browsers to attacker-controlled hosts immediately after Portal page loads.
Session token reuse from unusual geolocations or user agents shortly after a user clicked an external link to the Portal.

Detection Strategies

Inspect web server and reverse proxy logs for reflected parameters containing script tokens such as onerror=, onload=, <svg, or URL-encoded equivalents targeting Portal endpoints.
Deploy a web application firewall (WAF) ruleset that flags common XSS payload patterns on the Portal for ArcGIS request path.
Correlate email gateway telemetry for links pointing to Portal for ArcGIS hostnames with query strings that carry high-entropy or script-like content.

Monitoring Recommendations

Enable HTTP request and response logging on the Portal for ArcGIS web adaptor and forward logs to a central SIEM.
Monitor for anomalous authenticated REST API calls that follow shortly after a user session begins from an external referer.
Alert on Portal administrator sessions initiated from links containing query parameters not produced by Esri workflows.

How to Mitigate CVE-2026-69234

Immediate Actions Required

Apply the Esri patches for ArcGIS Enterprise 11.1, 11.3, and 11.5 as documented in the vendor bulletin.
Upgrade unsupported deployments to the latest long-term support release of ArcGIS Enterprise.
Migrate away from ArcGIS Web App Builder developer edition to ArcGIS Experience Builder, since the developer edition is unsupported.
Notify ArcGIS Enterprise users about phishing risk and instruct them to avoid clicking Portal links from untrusted sources until patches are deployed.

Patch Information

Esri has published fixes as part of the August 2026 ArcGIS Security Bulletin. Administrators should install the Portal for ArcGIS security patches corresponding to their deployed version (11.1, 11.3, or 11.5). Full patch details and download locations are available in the Esri ArcGIS Security Bulletin.

Workarounds

Restrict Portal for ArcGIS access to trusted networks or VPN users while patching is in progress.
Deploy a WAF policy in front of the Portal web adaptor to block requests containing common XSS payload signatures.
Set a strict Content Security Policy (CSP) header on the Portal origin to reduce the impact of injected script.
Configure session cookies with HttpOnly and Secure flags and enforce short session lifetimes for administrative accounts.

bash

# Example WAF rule (ModSecurity-style) blocking reflected script payloads to Portal for ArcGIS
SecRule REQUEST_URI "@beginsWith /portal/" \
  "chain,phase:2,deny,status:403,id:1026069234,\
  msg:'Potential CVE-2026-69234 reflected XSS attempt'"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:|<svg)" \
    "t:none,t:urlDecodeUni,t:htmlEntityDecode"