Portal for ArcGIS CVE-2026-69229

Exploitation requires a valid low-privilege authenticated account on the targeted Portal for ArcGIS instance (PR:L per CVSS vector). The portal must be running a version between 11.1 and 12.0 inclusive. Network access to the portal is required (AV:N), but no elevated or administrative privileges are needed - any user who can log in and submit content to the Home application is a potential attacker. Exploitation impact on victims is limited by the need for other users to load the affected page (though the vendor vector asserts UI:N, which is inconsistent with HTML injection affecting third parties - this condition should be verified). No non-default configuration or special feature enablement is indicated. Exploitation is limited by: (1) attacker must hold a portal account, (2) impact scope is limited to the Portal Home application and does not indicate OS-level or backend compromise, and (3) no availability impact.

The vendor-assigned CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) warrants scrutiny on the UI:N metric. HTML injection vulnerabilities that affect other users viewing a shared page inherently depend on victim interaction - UI:R is typically more accurate for content injection flaws of this class. If UI:R is more appropriate, the realistic score would be lower than 5.4. This metric inconsistency should be verified against the Esri advisory. No EPSS score was provided in the available intelligence, and the vulnerability is not listed in CISA KEV, meaning no public evidence of active exploitation exists at time of analysis. The PR:L requirement limits exploitation to users who already hold a portal account, meaningfully narrowing the attacker surface in organizations with strict account provisioning. No POC exploit code has been identified. Combined, these signals suggest this is a genuine but moderate-priority remediation item rather than an emergency response scenario - elevated in environments where untrusted or external users hold portal accounts.

An attacker with a low-privilege portal account crafts a malicious HTML payload and submits it to an input field in the Portal for ArcGIS Home application that is insufficiently sanitized. When other authenticated portal users load the Home application, the injected HTML renders in their browser, potentially redirecting them to a phishing page, displaying deceptive UI overlays, or - depending on the injection context - executing JavaScript to steal session tokens. No public exploit code exists at time of analysis, but the attack is low-complexity for anyone with basic web security knowledge and a valid portal account.