CVE-2026-69235: Esri Portal for ArcGIS XSS Vulnerability

CVE-2026-69235 Overview

CVE-2026-69235 is a stored cross-site scripting (XSS) vulnerability affecting Esri Portal for ArcGIS versions 11.5 and prior. A remote, privileged attacker can inject malicious script content that executes in the browser of any user who later views the affected resource. Because the payload persists server-side, the attack surface expands with every subsequent victim interaction. Esri has released fixes for ArcGIS Enterprise 11.1, 11.3, and 11.5, and recommends upgrading to the latest long-term support release. The issue maps to [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
An authenticated attacker with elevated privileges can persistently store JavaScript that runs in victim browsers, enabling session theft, phishing, and unauthorized actions in the ArcGIS Portal context.

Affected Products

Esri Portal for ArcGIS 11.5
Esri Portal for ArcGIS 11.3
Esri Portal for ArcGIS 11.1 and prior

Discovery Timeline

2026-08-21 - CVE-2026-69235 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-69235

Vulnerability Analysis

The flaw is a stored XSS condition in Esri Portal for ArcGIS. User-supplied input reaches a rendered page context without sufficient neutralization of HTML or JavaScript. Because the input is stored server-side, the injected payload executes each time another user loads the affected view. Exploitation requires user interaction, and the injected script runs in a different security scope than the vulnerable component, which is why the CVSS vector reports a scope change.

The attacker must already hold privileged access to submit the malicious content. Once stored, the payload runs with the privileges of the viewing user, which may include administrators. This creates a path for privilege abuse across accounts, session token exfiltration, and forged administrative requests inside the Portal.

Root Cause

The root cause is missing or incomplete output encoding on a Portal field that accepts rich content. Input containing HTML or script constructs is persisted verbatim and later rendered inline, allowing browser execution instead of literal display. Esri addressed the issue by adding proper sanitization in the August 2026 security bulletin release.

Attack Vector

Exploitation proceeds in three stages. First, an authenticated attacker with sufficient Portal privileges submits crafted content containing a JavaScript payload into a vulnerable field. Second, the payload is persisted in Portal storage. Third, a victim navigates to a page that renders the stored content, triggering script execution in the victim's session. Consult the Esri ArcGIS Security Bulletin for vendor-supplied technical details.

Detection Methods for CVE-2026-69235

Indicators of Compromise

Portal items, descriptions, or metadata fields containing <script>, onerror=, onload=, or javascript: URI patterns.
Unexpected outbound requests from analyst browsers to attacker-controlled domains shortly after loading Portal pages.
New or modified Portal content authored by privileged accounts outside of normal change windows.

Detection Strategies

Review Portal item content and shared resource fields for HTML tags and inline event handlers that should not appear in normal user input.
Enable and inspect ArcGIS Portal audit logs for content-edit events by privileged users and correlate with follow-on viewer sessions.
Deploy Content Security Policy (CSP) reporting to surface script-source violations originating from Portal-rendered pages.

Monitoring Recommendations

Alert on Portal responses that include user-authored content with <script> tags or JavaScript event attributes.
Track anomalous administrative API calls that immediately follow a Portal page view, which may indicate hijacked sessions.
Monitor privileged account activity for creation or modification of shared items, groups, and web maps.

How to Mitigate CVE-2026-69235

Immediate Actions Required

Apply the Esri patches for ArcGIS Enterprise 11.1, 11.3, and 11.5 as published in the August 2026 security bulletin.
Upgrade to the current long-term support release of ArcGIS Enterprise where feasible.
Audit privileged Portal accounts and remove unnecessary publisher or administrator rights.
Force session invalidation and credential rotation for administrators after patching.

Patch Information

Esri published fixes in the August 2026 ArcGIS Security Bulletin. Patches are available for ArcGIS Enterprise 11.1, 11.3, and 11.5. Administrators are advised to upgrade to the latest long-term support release for continued coverage.

Workarounds

Restrict Portal content creation privileges to a minimal set of vetted administrators until patching completes.
Enforce a strict Content Security Policy that disallows inline scripts on Portal-rendered pages.
Require re-authentication for administrative actions and shorten session lifetimes for privileged users.

bash

# Configuration example
# Refer to the Esri ArcGIS Security Bulletin for vendor-supplied upgrade guidance.
# https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/august-2026-arcgis-security-bulletin