Description

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, 12.0 or 12.1 are encouraged to patch. All users are advised to upgrade to the latest long-term support release and apply the patch.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-21T21:17:04.380Z",
  "pubdate": "2026-08-21T21:17:04.380Z",
  "executiveSummary": "A stored cross-site scripting vulnerability has been identified in Esri Portal for ArcGIS versions 12.1 and prior, as well as specific versions including ArcGIS Enterprise 11.1, 11.3, 11.5, 12.0, and 12.1.\nThe vulnerability allows a remote, privileged attacker to inject malicious scripts into the application, which are subsequently stored and persisted within the system.\nWhen a victim accesses the affected component, the injected arbitrary JavaScript executes within the security context of the victim’s browser session.\nThe primary impact involves potential session hijacking, unauthorized actions performed on behalf of the user, and exposure of sensitive data accessible via the web interface.\nExploitation requires the attacker to possess privileged access within the application to successfully inject the malicious payload into the targeted storage vector.\nRisk implications remain significant due to the potential compromise of user sessions and enterprise data integrity within affected deployments.\nUsers are strongly advised to apply the available security patches and upgrade to the latest long-term support release to mitigate the associated risks.",
  "technicalDetails": "The vulnerability stems from insufficient validation and sanitization of user-supplied input prior to persistent storage within Esri Portal for ArcGIS versions 12.1 and prior, including related ArcGIS Enterprise deployments such as versions 11.1, 11.3, 11.5, 12.0, and 12.1.\nThe root cause is characterized by improper output encoding when rendering stored data within the web-based user interface, allowing injected script tags and event handlers to be interpreted directly as executable markup by the browser.\nExploitation requires the attacker to authenticate to the application with elevated privileges necessary to supply and persist the malicious payload within the vulnerable component.\nThe attack flow proceeds as follows: First, the privileged attacker crafts a malicious input string containing arbitrary JavaScript payloads. Second, the attacker submits this payload through an administrative or authorized interface, causing the application to write the unsanitized data directly to the underlying database or storage mechanism without proper escaping. Third, an unsuspecting victim navigates to the affected page or resource within Portal for ArcGIS. Fourth, the application retrieves the stored data and renders it directly into the Document Object Model (DOM) without adequate context-aware output encoding. Fifth, the victim's browser parses the HTTP response, executes the embedded JavaScript payload within the session context, and exposes sensitive session tokens, cookies, or performs unauthorized operations on behalf of the user.\nThe network exposure is associated with the web interface of Portal for ArcGIS, where remote attackers interact with the application over standard HTTP/HTTPS protocols.\nPost-exploitation impact includes the execution of arbitrary JavaScript, potential session hijacking, unauthorized API calls made using the victim's privileges, and further compromise of the enterprise GIS environment depending on the victim's permission level."
}