Description

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-21T21:17:03.787Z",
  "pubdate": "2026-08-21T21:17:03.787Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 11.5 and prior, specifically impacting ArcGIS Enterprise versions 11.1, 11.3, and 11.5. This security flaw enables a remote, privileged attacker to inject and persist malicious script content within the application's data store.\nWhen targeted users interact with the compromised interface, the injected malicious code executes within the context of the victim's browser session. The primary impact includes potential session hijacking, unauthorized actions performed on behalf of the victim, and data exposure within the affected enterprise environment.\nExploitation requires the attacker to possess elevated privileges to inject the payload, alongside user interaction where a victim accesses the compromised resource. The risk implications are severe for enterprise deployments lacking proper input sanitization or output encoding mechanisms.\nMitigation requires applying the recommended software patches provided by the vendor or upgrading to the latest long-term support release to secure the web application infrastructure.",
  "technicalDetails": "The vulnerability is a stored cross-site scripting (XSS) issue located within Esri Portal for ArcGIS versions 11.5 and prior, affecting deployments running ArcGIS Enterprise 11.1, 11.3, and 11.5. The root cause stems from insufficient input sanitization and improper output encoding of user-supplied data before it is stored in the application's repository and subsequently rendered in the Document Object Model (DOM) of other users' browsers.\nAn attack requires authentication and privileged access, allowing the threat actor to submit malicious payloads—typically crafted JavaScript—into vulnerable input vectors within the portal interface. The application stores this input persistently in the underlying database without neutralizing executable HTML or script tags.\nThe attack flow proceeds as follows: First, the privileged attacker crafts an HTTP request containing the malicious JavaScript payload and submits it to a vulnerable endpoint within Esri Portal for ArcGIS. Second, the application processes the request and persists the malicious payload within the database storage. Third, an unsuspecting victim navigates to the application view or resource where the stored payload is retrieved and rendered. Fourth, the victim's browser interprets the response and executes the injected script within the security context of the victim's active session, possessing access to session tokens, cookies, and DOM elements.\nNetwork exposure is inherent to web-based deployments of ArcGIS Enterprise accessible via standard HTTP/HTTPS protocols. The post-exploitation impact includes unauthorized execution of arbitrary JavaScript, potential compromise of user sessions, actions performed under the victim's privilege level, and further exploitation of the internal enterprise GIS infrastructure."
}