CVE-2026-69238: 
Portal for ArcGIS vulnerability analysis and mitigation

CVE-2026-69238 is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 through 11.5 that allows a remote, highly privileged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. The vulnerability was published on August 21, 2026, and affects deployments on both Windows and Linux platforms. Users running ArcGIS Enterprise versions 11.1, 11.3, and 11.5 are specifically encouraged to patch. It carries a CVSS v3.1 base score of 3.5 (Low), assigned by Esri (GitHub Advisory, Esri Security Bulletin).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting), where user-controllable input is not properly sanitized before being rendered in the Portal for ArcGIS Home application. Exploitation requires the attacker to already hold high privileges within the portal and also requires a victim user to interact with the injected content (e.g., by visiting the affected page). The attack vector is network-based with low complexity, but the high privilege requirement and mandatory user interaction significantly constrain the exploitability. No specific technical write-ups or public proof-of-concept code have been identified (GitHub Advisory, Esri Security Bulletin).

Successful exploitation allows a highly privileged attacker to inject arbitrary HTML into the Portal for ArcGIS Home application, potentially enabling UI defacement, phishing attacks against portal users, or manipulation of displayed content. The confidentiality and integrity impacts are rated Low, with no availability impact, meaning an attacker could expose limited information or alter the appearance of the application but cannot directly crash or deny service. The scope is unchanged, limiting the blast radius to the affected portal component rather than enabling lateral movement to other systems (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the publication date (GitHub Advisory). The EPSS score is approximately 0.142% (4th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Esri has released patches for ArcGIS Enterprise versions 11.1, 11.3, and 11.5, and all users are advised to upgrade to the latest long-term support release of Portal for ArcGIS. Administrators should prioritize applying the available patches, particularly for internet-facing deployments. Restricting high-privilege account access and monitoring for unexpected HTML content changes in the Portal Home application can serve as interim risk-reduction measures (Esri Security Bulletin, GitHub Advisory).