Description

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release. Users working with ArcGIS Web App Builder developer edition are advised to migrate to ArcGIS Experience Builder, as ArcGIS Web App Builder developer edition is unsupported when this CVE is assigned.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-21T21:17:04.140Z",
  "pubdate": "2026-08-21T21:17:04.140Z",
  "executiveSummary": "A reflected cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 11.5 and prior, as well as ArcGIS Web App Builder developer edition. The vulnerability stems from insufficient input sanitization or output encoding within the affected web application components, allowing malicious user input to be reflected back in the Document Object Model (DOM) without proper validation. The primary impact of this flaw is the potential execution of arbitrary JavaScript code within the security context of a victim's browser session, which can lead to session hijacking, unauthorized data access, and unauthorized actions performed on behalf of the authenticated user. The risk implication is significant for organizations utilizing ArcGIS Enterprise 11.1, 11.3, and 11.5, as an external adversary can leverage social engineering techniques to compromise users. The attacker capabilities require no prior authentication, relying instead on remote exploitation vectors such as a crafted malicious hyperlink delivered via phishing or other delivery mechanisms. Successful exploitation mandates user interaction, specifically requiring the victim to click the malicious link and load the vulnerable application endpoint in their browser. Mitigations require applying official patches provided by the vendor for supported versions and migrating deprecated components to supported alternatives.",
  "technicalDetails": "The vulnerability is classified as a Reflected Cross-Site Scripting (XSS) flaw affecting Esri Portal for ArcGIS versions 11.5 and prior, including specific deployments on ArcGIS Enterprise 11.1, 11.3, and 11.5, alongside ArcGIS Web App Builder developer edition. The root cause of the vulnerability lies in the application's failure to adequately sanitize and contextually encode user-supplied input parameters before rendering them within the Hypertext Markup Language (HTML) response or executing DOM-based operations. This lack of strict input validation and output encoding allows malicious payloads containing executable script tags or event handlers to be injected into HTTP requests.\nThe network exposure for this vulnerability is remote, as the vulnerable components are accessible over the network via standard HTTP/HTTPS protocols. The authentication requirements for initiating the attack are unauthenticated, meaning an external malicious actor does not need valid user credentials or prior system access to construct the exploit. Similarly, privilege requirements are minimal for the attacker, who relies on the privileges of the victim user once the attack payload executes within the browser context.\nThe attack flow proceeds in a sequential manner. First, the remote unauthenticated attacker crafts a malicious Uniform Resource Locator (URL) containing an arbitrary JavaScript payload embedded within a vulnerable parameter. Second, the attacker induces a targeted victim user to click the crafted link through social engineering vectors such as phishing emails, malicious advertisements, or external messaging platforms. Third, the victim's browser sends an HTTP request containing the malicious payload to the vulnerable Esri Portal for ArcGIS server endpoint. Fourth, the server processes the request and reflects the unsanitized input back within the HTTP response or the application's client-side scripts. Finally, the victim's browser parses the HTTP response, fails to identify the content as untrusted, and executes the arbitrary JavaScript code in the context of the session.\nThe payload behavior during post-exploitation includes executing malicious scripts that have full access to the Document Object Model (DOM) of the vulnerable application. This permits the script to read sensitive session tokens, manipulate page content, bypass standard Same-Origin Policy (SOP) restrictions where applicable, extract sensitive data accessible to the user, or perform privileged actions directly through the authenticated user's active session. Remediation requires updating the affected software to the latest patched releases or long-term support versions."
}