Description

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-21T21:17:03.907Z",
  "pubdate": "2026-08-21T21:17:03.907Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists within Esri Portal for ArcGIS versions 11.5 and prior, including ArcGIS Enterprise 11.1, 11.3, and 11.5.\nThe flaw allows a remote, privileged attacker to inject malicious scripts into the application, which are subsequently stored and persisted within the affected system.\nWhen a victim views the compromised component, the injected payload executes arbitrary JavaScript within the context of the victim's browser session.\nThe successful exploitation of this vulnerability can lead to unauthorized actions performed on behalf of the victim, session hijacking, or exposure of sensitive data within the application scope.\nPrerequisites for exploitation include remote network access and authenticated privileges sufficient to inject the malicious content into the vulnerable storage mechanism.",
  "technicalDetails": "The vulnerability is classified as a stored cross-site scripting issue, stemming from insufficient input sanitization and output encoding of user-supplied data handled by the vulnerable component of Esri Portal for ArcGIS.\nAffected products include Esri Portal for ArcGIS versions 11.5 and prior, with specific emphasis on ArcGIS Enterprise deployments running versions 11.1, 11.3, and 11.5.\nExploitation requires a remote attacker to possess authenticated access with administrative or high-level privileges to input and store the malicious payload within the application data store or parameter fields.\nThe attack flow proceeds as follows: First, the privileged attacker crafts a malicious JavaScript payload designed to interact with the victim's session or execute unauthorized commands within the application interface. Second, the attacker submits this payload via an administrative or data input interface, where the application improperly validates or sanitizes the input before persisting it to the backend database. Third, when a victimized user accesses the specific portal view, dashboard, or component rendering the stored data, the application returns the unescaped payload within the HTTP response. Finally, the victim's browser parses the response and executes the arbitrary JavaScript in the context of the origin, granting the payload access to session tokens, cookies, and document object model (DOM) elements.\nPost-exploitation impact includes potential session compromise, unauthorized modification of portal settings, or further lateral movement depending on the privileges of the interacting victim."
}