Portal for ArcGIS CVE-2026-69234

User interaction is mandatory - the victim must click a specially crafted link (confirmed by CVSS UI:R). The attacker requires no authentication against the Portal (PR:N per CVSS vector) and needs only network-level access to a reachable Portal for ArcGIS instance running version 11.5 or earlier. Impact is amplified when the victim holds an active authenticated session, as the injected script would execute with the victim's privileges and could access tokens or perform actions across the ArcGIS Enterprise deployment (CVSS S:C). Exploitation is limited by the social engineering requirement - automated scanning tools cannot trigger this vulnerability without a human victim interaction. There is no indication that a specific non-default configuration is required; the vulnerability appears to exist in standard Portal deployments on affected versions.

The CVSS 6.1 Medium score is driven by a network attack vector with low complexity and no attacker privileges required, partially offset by the mandatory user-interaction (UI:R) requirement and limited confidentiality and integrity impacts (C:L/I:L). The Scope:Changed (S:C) metric elevates concern beyond what the score alone suggests, as it reflects real potential for cross-component token theft within an ArcGIS Enterprise deployment. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified from this analysis. This CVE is not in CISA KEV, and no public exploit code has been identified at time of analysis - these signals together suggest no widespread opportunistic exploitation is currently occurring. Real-world priority should be calibrated to the sensitivity of the data managed through the Portal: organizations using ArcGIS Enterprise for critical infrastructure or sensitive government data face meaningfully higher impact from session hijacking than the raw CVSS score implies. The UI:R requirement is the primary exploitation barrier and the key control point defenders can influence through user awareness and access restrictions.

An attacker crafts a URL containing a reflected XSS payload targeting a vulnerable Portal for ArcGIS endpoint and distributes it to targeted users - such as GIS administrators or data analysts - via a phishing email or compromised internal communication channel. When the victim clicks the link while holding an active Portal session, the injected JavaScript executes in their browser and can exfiltrate session cookies or tokens, enabling the attacker to impersonate the victim across connected ArcGIS Enterprise services. No public exploit code has been identified at time of analysis, so exploitation currently requires manual payload construction and social engineering to induce the victim click.