Read the docs
TI-2026-48571 Aliases CVE-2026-69230GHSA-fx97-qx2h-j535

stored cross site scripting issue in Esri Portal for ArcGIS

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00242 15th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EsriPortal for ArcGIS11.1 – 11.5—No fix listedCNA
  • Portal for ArcGIS VendorEsri Affected 11.1 – 11.5 Fixed in — No fix listed CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*before 11.1VulnerableEsri
cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*11.1VulnerableEsri
cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*11.1 security_2024_update1VulnerableEsri
cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*11.1 security_2024_update2VulnerableEsri
cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*11.1 security_2025_update1VulnerableEsri
cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*11.1 security_2025_update2VulnerableEsri
cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update3:*:*:*:*:*:*11.1 security_2025_update3VulnerableEsri
cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2026_update2:*:*:*:*:*:*11.1 security_2026_update2VulnerableEsri
cpe:2.3:a:esri:portal_for_arcgis:11.2:*:*:*:*:*:*:*11.2VulnerableEsri
cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*11.3VulnerableEsri
  • cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:* Versions before 11.1 Vulnerable ·Esri
  • cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:* Versions 11.1 Vulnerable ·Esri
  • cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:* Versions 11.1 security_2024_update1 Vulnerable ·Esri
  • cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:* Versions 11.1 security_2024_update2 Vulnerable ·Esri
  • cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:* Versions 11.1 security_2025_update1 Vulnerable ·Esri
  • cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:* Versions 11.1 security_2025_update2 Vulnerable ·Esri
  • cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update3:*:*:*:*:*:* Versions 11.1 security_2025_update3 Vulnerable ·Esri
  • cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2026_update2:*:*:*:*:*:* Versions 11.1 security_2026_update2 Vulnerable ·Esri
  • cpe:2.3:a:esri:portal_for_arcgis:11.2:*:*:*:*:*:*:* Versions 11.2 Vulnerable ·Esri
  • cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:* Versions 11.3 Vulnerable ·Esri
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*11.3 security_2025_update1VulnerableEsri
cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*11.3 security_2025_update2VulnerableEsri
cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update3:*:*:*:*:*:*11.3 security_2025_update3VulnerableEsri
cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2026_update2:*:*:*:*:*:*11.3 security_2026_update2VulnerableEsri
cpe:2.3:a:esri:portal_for_arcgis:11.4:*:*:*:*:*:*:*11.4VulnerableEsri
cpe:2.3:a:esri:portal_for_arcgis:11.5:-:*:*:*:*:*:*11.5VulnerableEsri
cpe:2.3:a:esri:portal_for_arcgis:11.5:security_2026_update1:*:*:*:*:*:*11.5 security_2026_update1VulnerableEsri
cpe:2.3:a:esri:portal_for_arcgis:11.5:security_2026_update2:*:*:*:*:*:*11.5 security_2026_update2VulnerableEsri
  • cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:* Versions 11.3 security_2025_update1 Vulnerable ·Esri
  • cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:* Versions 11.3 security_2025_update2 Vulnerable ·Esri
  • cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update3:*:*:*:*:*:* Versions 11.3 security_2025_update3 Vulnerable ·Esri
  • cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2026_update2:*:*:*:*:*:* Versions 11.3 security_2026_update2 Vulnerable ·Esri
  • cpe:2.3:a:esri:portal_for_arcgis:11.4:*:*:*:*:*:*:* Versions 11.4 Vulnerable ·Esri
  • cpe:2.3:a:esri:portal_for_arcgis:11.5:-:*:*:*:*:*:* Versions 11.5 Vulnerable ·Esri
  • cpe:2.3:a:esri:portal_for_arcgis:11.5:security_2026_update1:*:*:*:*:*:* Versions 11.5 security_2026_update1 Vulnerable ·Esri
  • cpe:2.3:a:esri:portal_for_arcgis:11.5:security_2026_update2:*:*:*:*:*:* Versions 11.5 security_2026_update2 Vulnerable ·Esri

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-69230
  2. 2026-10-03 Alias added: GHSA-fx97-qx2h-j535

References

Advisory 1

  • TI-2024-16901 Portal for ArcGIS has a directory traversal vulnerability. CVSS 3.1CRITICAL 9.9
  • TI-2026-11074 Missing authentication in Esri Portal for ArcGIS CVSS 3.1CRITICAL 9.8
  • TI-2025-02208 BUG-000174336 CVSS 3.1CRITICAL 9.8
  • TI-2026-25915 Incorrect privilege assignment in Portal for ArcGIS CVSS 3.1CRITICAL 9.8
  • TI-2026-25914 Incorrect privilege assignment in Portal for ArcGIS CVSS 3.1CRITICAL 9.8
  • TI-2025-04452 Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS CVSS 3.1CRITICAL 9.1
See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences