Description

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-21T21:17:03.670Z",
  "pubdate": "2026-08-21T21:17:03.670Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability has been identified in Esri Portal for ArcGIS versions 11.5 and prior. This security flaw enables a remote attacker with administrative privileges to inject arbitrary malicious client-side code, such as JavaScript, into the application storage. When a victim subsequently accesses the compromised resource within the enterprise environment, the malicious payload executes within the context of their browser session. The primary impact includes potential session hijacking, unauthorized data access, and unauthorized actions performed on behalf of the victim. Affected systems include deployments running ArcGIS Enterprise 11.1, 11.3, and 11.5. The risk implications are significant as administrative compromise can lead to broader enterprise infrastructure exposure. Exploitation of this vulnerability specifically requires administrative privileges within the targeted portal instance, meaning an adversary must first compromise or possess high-level administrative credentials. Remediation involves applying the provided patches or upgrading to the latest long-term support release of the software as recommended by the vendor.",
  "technicalDetails": "The vulnerability resides in Esri Portal for ArcGIS versions 11.5 and prior, specifically within components handling administrative inputs that fail to properly sanitize or encode user-supplied data before persistence. The root cause is rooted in improper input validation and output encoding, allowing malicious strings containing executable script tags or event handlers to be stored directly within the application database or file repository without adequate neutralization.\nExploitation of this stored XSS vector requires an authenticated attacker who possesses administrative privileges within the Esri Portal for ArcGIS environment. The attacker interacts with vulnerable administrative interfaces to inject malicious payloads into application fields that persist across sessions. When an administrative user or other targeted victims navigate to the affected page or view the compromised component, the web application serves the stored malicious payload as part of the Hypertext Markup Language (HTML) response without proper contextual output encoding.\nThe attack flow proceeds as follows: First, the privileged attacker crafts a malicious payload designed to execute arbitrary script code in the browser. Second, the attacker submits this payload through an administrative interface in Esri Portal for ArcGIS, where it is improperly validated and stored persistently. Third, a victim accesses the affected functional area within the application. Fourth, the server retrieves the malicious payload from storage and renders it within the victim's browser context. Fifth, the browser interprets the input as executable code, running the malicious script with the privileges and session context of the victim.\nThe network exposure includes any deployment of the affected Esri Portal for ArcGIS versions accessible via the network where administrative functions are exposed. The payload behavior involves executing arbitrary instructions within the victim's browser session, which can interact with the Document Object Model (DOM), access sensitive session tokens, cookies, or make unauthorized asynchronous requests to the underlying ArcGIS Enterprise APIs. Post-exploitation impact encompasses potential full session compromise, unauthorized modification of portal configurations, or pivoting actions executed under the authority of the victimized user session."
}