Portal for ArcGIS CVE-2026-69230

Exploitation requires the attacker to possess a valid account with administrative privileges on the targeted Portal for ArcGIS instance (CVSS PR:H confirms this). The attacker must have sufficient portal permissions to create or modify content fields that are subsequently rendered without output encoding in other users' sessions. Exploitation is further conditioned on at least one victim user loading the portal page containing the injected payload - the stored script does not execute autonomously. Limiting factors: the admin-privilege requirement (PR:H) rules out unauthenticated network attackers and standard portal users; the vulnerability is not exploitable from the network without valid admin credentials. No non-default configuration is described as required - any Portal for ArcGIS deployment at or below version 11.5 where admin access exists is in scope.

The vendor-assigned CVSS base score of 5.5 (Medium) reflects the mitigating factor of PR:H - exploitation requires pre-existing administrative access to the portal instance, substantially narrowing the realistic attacker pool to insiders, compromised admin accounts, or social-engineered administrators. The scope change (S:C) is the key risk amplifier: a single admin-level injection can silently affect an unbounded number of lower-privileged users who load the poisoned content. No EPSS score was provided in the source data, preventing a probabilistic exploitation estimate. The absence of a CISA KEV listing and no reported POC code both suggest this has not yet seen opportunistic or widespread exploitation. Attack complexity is low (AC:L), meaning no special preconditions beyond valid admin credentials are needed. Practically, the most realistic threat model is a malicious insider or a scenario where an admin account is phished or credential-stuffed. The UI:N rating in the vendor vector warrants scrutiny - stored XSS payloads require a victim to load the affected page, suggesting UI:R may be more precise, though NVD convention on stored XSS varies.

An attacker who has obtained valid administrative credentials - through phishing, credential reuse, or insider access - logs into Portal for ArcGIS and injects a JavaScript payload into a portal item description, gallery entry, or configurable application field. The payload is stored server-side and silently executes in the browsers of any users who subsequently navigate to the affected portal page, allowing the attacker to harvest session tokens, redirect users to credential-harvesting sites, or perform actions on their behalf within the portal. No public exploit code has been identified at time of analysis.