CVE-2026-69237

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

CVSS v3 3.8 LOW

3.8^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/august-2026-arcgis-security-bulletin	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:esri:portal_for_arcgis::::::::
	cpe:2.3:a:esri:portal_for_arcgis:11.1:-::::::
	cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1::::::
	cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2::::::
	cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1::::::
	cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2::::::
	cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update3::::::
	cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2026_update2::::::
	cpe:2.3:a:esri:portal_for_arcgis:11.2:::::::*
	cpe:2.3:a:esri:portal_for_arcgis:11.3:-::::::
	cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1::::::
	cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2::::::
	cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update3::::::
	cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2026_update2::::::

History

No history.

Information

Published : 2026-08-21 21:17

Updated : 2026-09-11 20:18

NVD link : CVE-2026-69237

Mitre link : CVE-2026-69237

CVE.ORG link : CVE-2026-69237

JSON object : View

Products Affected

esri

portal_for_arcgis

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-69237", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-69237", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T12:44:30.798638Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@esri.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "affected": [{"source": "psirt@esri.com", "affectedData": [{"vendor": "Esri", "product": "Portal for ArcGIS", "versions": [{"status": "affected", "version": "11.1", "versionType": "custom", "lessThanOrEqual": "11.3"}], "platforms": ["Windows", "Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-08-21T21:17:04.503", "references": [{"url": "https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/august-2026-arcgis-security-bulletin", "tags": ["Vendor Advisory"], "source": "psirt@esri.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@esri.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are advised to upgrade to the latest long-term support release."}], "lastModified": "2026-09-11T20:18:01.287", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E58D508-AABB-4147-8C91-D3AD2F967A57", "versionEndExcluding": "11.1"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57DA68A3-0E09-4C8C-A98E-B027964FA17A"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3A6B038-6C92-4A34-B980-E3872265FF89"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DA6D70E-60D6-4CE6-AFA4-7BB191A23E3B"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9FCD40AD-6D5B-498C-AFD7-B84B4FD1E3F3"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E2AE6CA-0F8E-4D40-94E3-FEAB2E7E2CF7"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB18AD2D-85F6-4F7F-8579-08DC03BB4092"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2026_update2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79940776-2AEC-4547-B7E6-6068C40B3E9F"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2E37361-8569-4023-BC3E-F36E7607CC7D"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF8719BA-95F6-4AB6-8A86-6742BE828260"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C19F9C7-F687-4865-8535-2E99E0AB0157"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC7EED3B-056E-4B86-94E4-FF0B62E376CA"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18EB24C5-1C1F-48C1-B2B1-B5D6F98D368D"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2026_update2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BAF3B185-270A-4228-86C8-57D20C8EDF5B"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@esri.com"}