Portal for ArcGIS CVE-2026-69233

Exploitation requires the attacker to hold an administratively privileged account on the target Portal for ArcGIS instance (confirmed by CVSS PR:H), accessible over the network (AV:N). The injected payload executes when another user's browser renders the affected Portal page containing the stored script. Exploitation is limited by: (1) the attacker must have admin-level credentials prior to injection - unauthenticated or low-privilege attackers cannot trigger this vulnerability; (2) a victim user must subsequently browse to the content where the payload is stored; (3) victims must be using a browser that executes JavaScript against the Portal's web interface. Deployments where Portal for ArcGIS administrative accounts are tightly controlled or protected by MFA face significantly reduced practical risk.

The CVSS base score of 5.5 appropriately reflects the high privilege prerequisite (PR:H), which is the dominant risk-reducing factor: exploitation requires the attacker to already hold administrative credentials on the Portal for ArcGIS instance. The network attack vector (AV:N) and low attack complexity (AC:L) indicate no lateral movement or special network positioning is required once admin access is obtained. The scope change (S:C) elevates the score beyond a simple low-impact finding because the attacker's payload affects users other than themselves. EPSS data is not provided in the intelligence set; given the PR:H requirement and absence of public exploit code or KEV listing, real-world opportunistic exploitation is unlikely. The realistic threat model is a compromised or malicious admin account using this vulnerability as a persistence or lateral movement tool against lower-privileged Portal users - not an external unauthenticated attacker. No EPSS or POC data conflicts with this assessment.

A threat actor with valid administrative credentials to a Portal for ArcGIS 11.5 instance injects a malicious JavaScript payload into a shared web map description, gallery item, or Portal configuration field. When any other authenticated Portal user views the affected content, their browser executes the attacker's script within the Portal's origin, potentially exfiltrating session tokens or performing actions on behalf of the victim. No public proof-of-concept code has been identified, but the attack technique is well-understood for stored XSS.