Description

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-21T21:17:04.260Z",
  "pubdate": "2026-08-21T21:17:04.260Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 11.5 and prior. This security flaw enables a remote, privileged attacker to inject malicious scripts into application data stores, which are subsequently rendered and executed within the context of a victim's browser session. The primary impact involves potential session hijacking, unauthorized data access, and unauthorized actions performed on behalf of the authenticated user within the affected web application. The affected systems include deployments running ArcGIS Enterprise versions 11.1, 11.3, and 11.5. Risk implications are significant due to the requirement of administrative or privileged access to inject the payload, coupled with the potential to compromise multiple standard or privileged users who interact with the stored malicious content. Exploitation prerequisites mandate that the attacker possesses the necessary privileges to inject data into the vulnerable component and that a victim subsequently accesses the compromised resource, triggering the script execution in their browser.",
  "technicalDetails": "The vulnerability is rooted in insufficient input sanitization and output encoding within Esri Portal for ArcGIS versions 11.5 and prior. Specifically, user-supplied data accepted by the application is stored persistently within the underlying database or data repository without proper neutralization of executable markup or script tags. When a user requests the affected resource, the application retrieves the stored payload and reflects it directly into the Document Object Model (DOM) of the HTTP response without enforcing strict context-aware output encoding or implementing a robust Content Security Policy (CSP). The attack vector is network-based and requires the attacker to authenticate with elevated privileges to inject the malicious payload into the vulnerable component. The attack flow initiates when the privileged attacker crafts an input containing malicious JavaScript and submits it to the vulnerable application endpoint. The application processes the request and persists the malicious payload into the storage layer without validation or sanitization. Subsequently, when an unsuspecting victim navigates to the compromised page or component, the server delivers the stored payload within the HTTP response. The victim's browser parses the response and executes the arbitrary script in the context of the user's session, inheriting the victim's session cookies and authorization privileges. Post-exploitation impact includes the potential extraction of sensitive session tokens, DOM modification, redirection to malicious external sites, or the execution of unauthorized transactional requests within the ArcGIS Enterprise environment."
}