CVE-2026-69236
EUVD-2026-6408621.08.2026, 21:17
There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, 12.0 or 12.1 are encouraged to patch. All users are advised to upgrade to the latest long-term support release and apply the patch.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| esri | portal_for_arcgis | 𝑥 < 11.1 |
| esri | portal_for_arcgis | 11.1 |
| esri | portal_for_arcgis | 11.1:security_2024_update1 |
| esri | portal_for_arcgis | 11.1:security_2024_update2 |
| esri | portal_for_arcgis | 11.1:security_2025_update1 |
| esri | portal_for_arcgis | 11.1:security_2025_update2 |
| esri | portal_for_arcgis | 11.1:security_2025_update3 |
| esri | portal_for_arcgis | 11.1:security_2026_update2 |
| esri | portal_for_arcgis | 11.2 |
| esri | portal_for_arcgis | 11.3 |
| esri | portal_for_arcgis | 11.3:security_2025_update1 |
| esri | portal_for_arcgis | 11.3:security_2025_update2 |
| esri | portal_for_arcgis | 11.3:security_2025_update3 |
| esri | portal_for_arcgis | 11.3:security_2026_update2 |
| esri | portal_for_arcgis | 11.4 |
| esri | portal_for_arcgis | 11.5 |
| esri | portal_for_arcgis | 11.5:security_2026_update1 |
| esri | portal_for_arcgis | 11.5:security_2026_update2 |
| esri | portal_for_arcgis | 12.0 |
| esri | portal_for_arcgis | 12.0:security_2026_update1 |
| esri | portal_for_arcgis | 12.0:security_2026_update2 |
| esri | portal_for_arcgis | 12.1 |
| esri | portal_for_arcgis | 12.1:security_2026_update2 |
𝑥
= Vulnerable software versions