CVE-2026-69230 Esri CVE debrief

Who should care

Administrators and users of Esri Portal for ArcGIS, particularly those using ArcGIS Enterprise 11.1, 11.3, and 11.5, should prioritize patching or upgrading to mitigate the stored cross-site scripting vulnerability. This includes reviewing and applying security updates from Esri, monitoring for potential exploitation attempts, and verifying affected scope and remediation steps.

Why it matters

CVE-2026-69230 is a stored cross-site scripting vulnerability in Esri Portal for ArcGIS that requires attention from administrators and users to prevent potential code execution and unauthorized actions.

• Potential code execution in a victim's browser
• Possible unauthorized actions within the Portal for ArcGIS
• Required verification of affected versions and remediation steps
• Need for administrators to apply patches or upgrades

Technical summary

The vulnerability exists in Esri Portal for ArcGIS versions 11.5 and prior, allowing an administratively privileged attacker to inject malicious code that may execute in a victim's browser. The issue is a stored cross-site scripting vulnerability that requires attention from administrators and users to prevent potential code execution and unauthorized actions within the Portal for ArcGIS. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch and upgrade to the latest long-term support release.

Defensive priority

Administrators of Esri Portal for ArcGIS should prioritize patching or upgrading to mitigate the stored cross-site scripting vulnerability.

Recommended defensive actions

• Patch or upgrade Esri Portal for ArcGIS to the latest version
• Review and apply security updates from Esri
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, and a vendor advisory is available from Esri. The Esri advisory provides detailed information about the vulnerability, affected versions, and recommended patches. Defenders should verify the affected scope, apply patches or upgrades, and monitor for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.