Portal for ArcGIS CVE-2026-69232

Exploitation requires the attacker to possess a high-privilege Portal for ArcGIS account with permission to create or edit portal content - such as publisher, content manager, or administrator roles - as confirmed by PR:H in the CVSS vector. The attacker must be able to submit stored content (items, group metadata, pages, or similar artifacts) that is subsequently rendered in the browsers of other authenticated portal users. The victim's browser must render the affected portal content, which occurs during normal portal browsing (no additional social engineering beyond the victim's routine portal use is required, consistent with UI:N in the vendor's CVSS vector). Exploitation is bounded to Portal for ArcGIS versions 11.1 through 11.5; environments upgraded beyond 11.5 per the vendor advisory are not affected. Unauthenticated external attackers or low-privilege portal members cannot trigger the injection without first escalating to a content-publishing role.

The CVSS 3.1 base score of 5.5 (Medium) is underpinned by vector AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N. The PR:H requirement is the primary limiting factor: an attacker must already hold a high-privilege portal account (publisher, content manager, or administrator role) to inject the stored payload, substantially narrowing the realistic attacker population to insiders or actors who have separately compromised a privileged credential. The S:C metric is noteworthy - it signals that the vulnerability's impact crosses the security boundary into victims' browser sessions, which justifies treating this above its raw score might suggest for affected environments with sensitive portal content. No EPSS score was included in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no proof-of-concept code has been identified, meaning real-world exploitation has not been observed or publicly demonstrated. Overall, this is a genuine medium-priority issue rather than a high-urgency emergency: the privilege prerequisite limits opportunistic exploitation, but organizations where privileged portal accounts are broadly distributed or where portal content is sensitive should treat remediation as time-bound.

An attacker who has obtained or compromised a privileged Portal for ArcGIS account (e.g., a publisher or administrator) injects a malicious JavaScript payload into a stored portal artifact such as a map item description, group detail, or dashboard component. When any other portal user - including lower-privileged staff or other administrators - navigates to the affected content during routine portal use, their browser automatically executes the stored script, which could silently transmit their session cookies to an attacker-controlled endpoint or perform portal API actions on their behalf. No public proof-of-concept code has been identified.