Description

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-21T21:17:04.617Z",
  "pubdate": "2026-08-21T21:17:04.617Z",
  "executiveSummary": "An HTML injection vulnerability has been identified in Esri Portal for ArcGIS versions 11.5 and prior.\nThis vulnerability allows a remote, highly privileged attacker to inject arbitrary HTML content into the Portal for ArcGIS Home application.\nThe primary impact of this flaw includes potential user interface manipulation, defacement, or context-dependent client-side attacks within the administrative or home application context.\nAffected products include ArcGIS Enterprise versions 11.1, 11.3, and 11.5, with all users advised to upgrade to the latest long-term support release or apply available patches.\nThe risk implication is moderate to high depending on the extent of administrative privilege abuse and the potential for secondary exploitation vectors such as stored cross-site scripting, although specific script execution capabilities depend on input sanitization filters.\nAttacker capabilities require authenticated access with highly privileged credentials to successfully inject and persist arbitrary HTML payloads within the targeted application interface.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and output encoding within the Portal for ArcGIS Home application.\nWhen user-supplied input or administrative configuration parameters are processed and subsequently rendered in the web interface, lack of proper contextual escaping allows arbitrary HTML tags to be interpreted and executed by the browser.\nThe vulnerable component resides within the Portal for ArcGIS Home application interface handling specific input vectors.\nAffected software versions include Esri Portal for ArcGIS 11.5 and prior, specifically impacting deployments running ArcGIS Enterprise versions 11.1, 11.3, and 11.5.\nAuthentication requirements dictate that an attacker must possess authenticated session access to the target system.\nPrivilege requirements are strict, necessitating a highly privileged attacker capable of modifying application parameters or administrative configurations that persist within the Portal for ArcGIS Home application.\nNetwork exposure is remote, as Portal for ArcGIS is typically accessible over corporate networks or the public internet depending on enterprise architecture configurations.\nThe attack flow begins with the authenticated, highly privileged attacker crafting a malicious payload containing arbitrary HTML structures.\nThe attacker then injects this payload into vulnerable input fields or configuration parameters exposed by the Portal for ArcGIS Home application.\nUpon saving, the application improperly sanitizes the input and stores the raw HTML within the backend data store or configuration repository.\nWhen an unsuspecting user or administrator loads the affected page within the Portal for ArcGIS Home application, the browser parses the unescaped HTML elements.\nPayload behavior involves the rendering of injected markup, which can alter the visual presentation of the application, deface the interface, or potentially execute malicious client-side scripts if script injection primitives are achievable through the HTML context.\nPost-exploitation impact includes compromised interface integrity, potential credential harvesting, session hijacking, or unauthorized actions performed within the context of the victim's browser session against the enterprise portal."
}