CVE-2026-69234

MEDIUM 6.1

reflected cross site scripting vulnerability in Esri Portal for ArcGIS

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release. Users working with ArcGIS Web App Builder developer edition are advised to migrate to ArcGIS Experience Builder, as ArcGIS Web App Builder developer edition is unsupported when this CVE is assigned.

CWE	CWE-79
Vendor	esri
Product	portal for arcgis
Published	Aug 21, 2026

Stay Ahead of the Next One

Get instant alerts for esri portal for arcgis

Be the first to know when new medium vulnerabilities affecting esri portal for arcgis are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Esri / Portal for ArcGIS

11.1 ≤ 11.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

esri.com: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/august-2026-arcgis-security-bulletin