Portal for ArcGIS CVE-2026-33520

Exploitation requires the attacker to deliver a crafted link to a victim and for that victim to click it (UI:R) - the payload is reflected, so there is no stored/persistent component and no attacker authentication is needed (PR:N). The affected scope is Esri ArcGIS (described as Portal for ArcGIS versions 12.1 and prior; CPE/remediation reference ArcGIS Server), so a reachable, vulnerable, unpatched instance must be exposed to the victim's browser. Limiting factors: success depends entirely on social-engineering the victim into clicking, impact is confined to the victim's browser session (low C/low I, no availability impact), and per the bulletin only General Availability and Extended support versions are patch-eligible (fix line 11.5) while mature or retired versions are not patch eligible and must be upgraded first.

This is a reflected cross-site scripting flaw (CWE-79) carrying a medium CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The signals are internally consistent and point to moderate, not critical, real-world risk: network-reachable and unauthenticated (PR:N) with low attack complexity, but gated by required victim interaction (UI:R) - the target must click an attacker-crafted link. Impact is limited to low confidentiality and low integrity with no availability effect, and the scope change (S:C) reflects script execution in the victim's browser context rather than compromise of the server itself. No EPSS score was supplied, the vulnerability is not listed in CISA KEV, and no public exploit or PoC reference is present in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' indicating a scheduled-remediation priority rather than emergency action. Net assessment: a genuine but second-tier issue - worth patching on a normal cycle, not a drop-everything event, because the UI:R requirement and browser-only impact substantially limit mass exploitation. One data caveat: the description names 'Esri Portal for ArcGIS' while the CPE and tags identify 'arcgis_server,' and the remediation text refers to 'ArcGIS Server' - the exact affected product line should be verified against the Esri bulletin.

An unauthenticated attacker crafts a malicious URL targeting a vulnerable ArcGIS endpoint and delivers it to a victim via phishing email, chat, or a planted link. When the authenticated or unauthenticated victim clicks it, the reflected payload executes arbitrary JavaScript in their browser session, enabling session-context actions such as stealing tokens or performing requests as the user. No public exploit or PoC reference was provided in the input.