CVE-2026-69238

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-69238
There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

3.5 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/august-2026-arcgis-security-bulletin Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*
cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*
cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*
cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*
cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*
cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*
cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update3:*:*:*:*:*:*
cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2026_update2:*:*:*:*:*:*
cpe:2.3:a:esri:portal_for_arcgis:11.2:*:*:*:*:*:*:*
cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*
cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*
cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*
cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update3:*:*:*:*:*:*
cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2026_update2:*:*:*:*:*:*
cpe:2.3:a:esri:portal_for_arcgis:11.4:*:*:*:*:*:*:*
cpe:2.3:a:esri:portal_for_arcgis:11.5:-:*:*:*:*:*:*
cpe:2.3:a:esri:portal_for_arcgis:11.5:security_2026_update1:*:*:*:*:*:*
cpe:2.3:a:esri:portal_for_arcgis:11.5:security_2026_update2:*:*:*:*:*:*
History

12 Oct 2026, 16:10

Type Values Removed Values Added
Summary
  • (es) Hay una vulnerabilidad de inyección HTML en Esri Portal for ArcGIS versiones 11.5 y anteriores que permite a un atacante remoto y con altos privilegios insertar HTML arbitrario en la aplicación Portal for ArcGIS Home. Se recomienda a los usuarios que trabajan con ArcGIS Enterprise 11.1, 11.3 y 11.5 que apliquen el parche. Se aconseja a todos los usuarios que actualicen a la última versión de soporte a largo plazo.
Information

Published : 2026-08-21 21:17

Updated : 2026-10-12 16:10

NVD link : CVE-2026-69238

Mitre link : CVE-2026-69238

CVE.ORG link : CVE-2026-69238

JSON object : View

Products Affected

esri

  • portal_for_arcgis
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')