Portal for ArcGIS CVE-2026-69238

Exploitation requires the attacker to hold a highly privileged account within the Portal for ArcGIS instance - specifically a portal administrator or equivalent role - as confirmed by the CVSS PR:H metric. A victim user with access to the Portal Home application must subsequently load the page containing the injected HTML (UI:R). The affected deployment must be running Portal for ArcGIS version 11.5 or earlier, specifically versions 11.1, 11.3, or 11.5 per Esri guidance. No non-default configuration is required - any standard Portal for ArcGIS installation within the version range is vulnerable given a compromised admin account. Limiting factors: the PR:H prerequisite makes unauthenticated or low-privilege exploitation impossible; UI:R prevents fully silent automated exploitation; and the S:U scope boundary prevents the attack from pivoting to other systems or applications.

The CVSS 3.5 Low score accurately reflects the compounded access constraints encoded in the vector AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N. An attacker must already hold highly privileged credentials within the portal (PR:H) and must rely on a victim user loading the affected page (UI:R), yielding only limited confidentiality and integrity exposure with zero availability impact. No EPSS data is available in the provided intelligence, and this CVE is absent from CISA KEV with no known POC - all signals collectively point to low urgency. The realistic threat model is a malicious insider or compromised administrator account using the injection to serve phishing content to other portal users; without first achieving high-privilege access, external attackers have no exploitation path. The S:U scope boundary means even a successful attack cannot spread beyond the Portal Home application. Organizations running public-facing or multi-tenant ArcGIS Enterprise deployments should treat this as routine patch-cycle maintenance rather than emergency remediation, though the high-privilege prerequisite means perimeter defenses alone are insufficient if admin account compromise is a concern.

A compromised or malicious portal administrator authenticates to an ArcGIS Enterprise 11.1-11.5 deployment and injects crafted HTML into a Portal Home application element - such as a featured item description or banner - visible to other portal users. When a victim user navigates to the portal, the injected content renders in their browser, potentially displaying a spoofed login prompt or redirecting them to a credential-harvesting site. No public exploit code is known at time of analysis, but the attack requires only basic web knowledge and administrative portal access.