esriCVE-2026-69234
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.
Medium6.1CVE-2026-69234 · Published Aug 21, 2026 · updated Sep 11, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Portal for ArcGIS Vendor | >= 11.1, <= 11.5 | No fix yet |
Details and references
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release. Users working with ArcGIS Web App Builder developer edition are advised to migrate to ArcGIS Experience Builder, as ArcGIS Web App Builder developer edition is unsupported when this CVE is assigned.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- no source yet
- Weakness
- CWE-79
More esri advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 21 | There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12. CVE-2026-69224Medium5.9no fix yet | Medium5.9 | No fix yet |
| Aug 21 | There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12. CVE-2026-69225Medium5.9no fix yet | Medium5.9 | No fix yet |
| Aug 21 | There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12. CVE-2026-69228Medium5.3no fix yet | Medium5.3 | No fix yet |
| Aug 21 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12. CVE-2026-69229Medium5.4no fix yet | Medium5.4 | No fix yet |
| Aug 21 | There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11. CVE-2026-69230Medium5.5no fix yet | Medium5.5 | No fix yet |
| Aug 21 | There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11. CVE-2026-69231Medium5.5no fix yet | Medium5.5 | No fix yet |