Description

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-21T21:17:04.023Z",
  "pubdate": "2026-08-21T21:17:04.023Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists within Esri Portal for ArcGIS versions 11.5 and prior. This security flaw enables a remote, administratively privileged attacker to inject arbitrary malicious script code into the application context, which is subsequently persisted and executed within the victim's browser session. The primary impact involves potential session hijacking, unauthorized data access, and unauthorized actions performed within the context of the affected user.\nAffected systems include ArcGIS Enterprise deployments running versions 11.1, 11.3, and 11.5. The risk implications are severe due to the requirement of administrative privileges for initial injection, potentially chaining higher-level compromises or targeting other administrative and standard users interacting with the portal interface. Exploitation requires administrative authentication and access to the management or configuration interfaces where input persistence occurs without adequate sanitization or output encoding.",
  "technicalDetails": "The vulnerability is a stored cross-site scripting (XSS) flaw localized within Esri Portal for ArcGIS versions 11.5 and prior, specifically impacting ArcGIS Enterprise 11.1, 11.3, and 11.5. The root cause stems from insufficient input sanitization and a lack of proper contextual output encoding applied to user-supplied data accepted through administrative interfaces.\nNetwork exposure is remote, leveraging the standard web application protocols utilized by the ArcGIS Enterprise suite. Authentication and privilege requirements dictate that the attacker must possess administrative privileges to inject the malicious payload into the application storage mechanism. The vulnerability involves the persistence of untrusted data in backend data stores, which is later retrieved and rendered in the Document Object Model (DOM) of unsuspecting users' browsers.\nThe attack flow proceeds as follows: First, an attacker with administrative credentials authenticates to the Esri Portal for ArcGIS interface. Second, the attacker submits a specially crafted payload containing malicious JavaScript through an administrative input vector that lacks proper validation. Third, the application stores this unsanitized payload persistently within the underlying database or configuration store. Fourth, when a victim accesses the affected portal interface or views the compromised component, the application serves the stored payload without neutralizing executable elements. Finally, the victim's browser parses and executes the arbitrary JavaScript within the security context of the application origin, leading to potential session compromise, disclosure of sensitive tokens, or unauthorized administrative actions executed on behalf of the victim."
}