CVE-2026-50096: 
ArcGIS Server vulnerability analysis and mitigation

CVE-2026-50096 is a reflected cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 12.1 and prior. It allows a remote, unauthenticated attacker to craft a malicious link that, when clicked by a victim, executes arbitrary JavaScript code in the victim's browser. The vulnerability was published on October 26, 2026, and affects ArcGIS Server versions 11.1 through below 12.1. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the reflected XSS variant. User-supplied input is not properly sanitized or encoded before being reflected back in the HTTP response, allowing injected JavaScript to execute in the victim's browser context. Exploitation requires no authentication and no elevated privileges, but does require user interaction — specifically, a victim must click a crafted link. No public proof-of-concept code has been identified at this time (GitHub Advisory, Esri Security Bulletin).

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the victim's browser session on the Portal for ArcGIS interface, potentially enabling session hijacking, credential theft, or defacement of the portal. Since Portal for ArcGIS is commonly used to manage and share geospatial data and services within organizations, a compromised session could expose sensitive organizational data or allow unauthorized administrative actions. Availability is not impacted, but both confidentiality and integrity are partially affected (GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable, as it requires a victim to click a crafted link (GitHub Advisory, Esri Security Bulletin).

1. Reconnaissance: Identify publicly accessible Esri Portal for ArcGIS instances running versions 11.1 through 12.1 using search engines, Shodan, or Censys.
2. Identify vulnerable parameter: Analyze the portal's web endpoints to locate input parameters that are reflected in HTTP responses without proper sanitization or encoding.
3. Craft malicious link: Construct a URL targeting the vulnerable endpoint with a JavaScript payload embedded in the reflective parameter, e.g., https://target-portal/arcgis/...?param=<script>malicious_code</script> or using encoded variants to bypass basic filters.
4. Deliver the link: Send the crafted URL to a target user via phishing email, social engineering, or other means to induce them to click it.
5. JavaScript execution: When the victim clicks the link and the portal reflects the unsanitized input, the injected JavaScript executes in the victim's browser, potentially stealing session cookies, capturing credentials, or performing actions on behalf of the victim (GitHub Advisory).

• Network: Unusual HTTP GET or POST requests to Portal for ArcGIS endpoints containing URL-encoded JavaScript payloads (e.g., <script>, javascript:, onerror=, onload=) in query parameters.
• Logs: Web server or portal access logs showing requests with suspicious parameter values containing HTML/JavaScript injection strings; repeated requests from the same IP to portal endpoints with varying payloads.
• Browser/Client: Unexpected redirects or pop-ups when accessing portal links; session tokens appearing in external network traffic originating from a user's browser session.

Esri has released patches for ArcGIS Server versions in General Availability and Extended support status: 12.1, 12.0, 11.5, 11.3, and 11.1. Users on versions in mature or retired support status are not eligible for patches and should upgrade to a supported version before applying the patch. As a general defense-in-depth measure, organizations should implement Content Security Policy (CSP) headers, enforce input validation and output encoding, and train users to avoid clicking unsolicited or suspicious links (Esri Security Bulletin, GitHub Advisory).