Description

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 and 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-21T21:17:03.547Z",
  "pubdate": "2026-08-21T21:17:03.547Z",
  "executiveSummary": "An HTML injection vulnerability has been identified in Esri Portal for ArcGIS versions 12.0 and prior, specifically impacting the Portal for ArcGIS Home application.\nThis security flaw enables a remote, authenticated attacker to inject arbitrary HTML markup into the application interface.\nThe primary risk associated with this vulnerability involves the potential manipulation of the user interface, which could facilitate downstream exploitation vectors such as cross-site scripting (XSS), session compromise, or unauthorized content rendering within the context of trusted users interacting with the affected portal.\nThe vulnerability requires the attacker to possess authenticated access to the target environment.\nUsers operating vulnerable iterations within ArcGIS Enterprise 11.1, 11.3, 11.5, and 12.0 are strongly encouraged to apply available patches.\nFurthermore, system administrators are advised to evaluate upgrade pathways to the latest long-term support release to ensure comprehensive risk reduction and overall security posture alignment.",
  "technicalDetails": "The vulnerability resides within the Portal for ArcGIS Home application component of Esri Portal for ArcGIS versions 12.0 and prior.\nThe root cause stems from insufficient input sanitization and context-aware output encoding of user-supplied data processed by the application.\nWhen the application fails to properly neutralize malicious or unexpected HTML characters and tags prior to rendering them within the Document Object Model (DOM), it allows arbitrary HTML injection.\nExploitation of this vulnerability is categorized as remote and requires the attacker to be authenticated to the platform.\nThe attack flow typically involves an authenticated user crafting a malicious payload containing arbitrary HTML elements and submitting it through application input vectors that lack adequate validation.\nUpon successful submission and subsequent rendering of the unsanitized input by the Portal for ArcGIS Home application, the injected HTML is processed by the victims' browsers.\nDepending on the nature of the injected markup, this behavior can manipulate the layout, mislead users via phishing-style interface alterations, or execute embedded scripts if the context permits secondary execution vectors.\nThe network exposure encompasses any deployment of the vulnerable Portal for ArcGIS software accessible over the network interface utilized by the enterprise architecture.\nPrivilege requirements mandate that the threat actor holds valid authentication credentials, allowing interaction with application functionalities that improperly handle input rendering.\nPost-exploitation impact includes degraded integrity of the web interface, potential theft of sensitive session tokens via secondary script execution, and unauthorized modification of the user's visual interaction context within ArcGIS Enterprise."
}