Portal for ArcGIS EUVD-2026-110062

Exploitation requires an attacker to craft a link containing a reflected XSS payload targeting an Esri ArcGIS instance at version 12.1 or prior, and requires the victim to actively click that attacker-supplied link (UI:R) - this user-interaction/social-engineering step is the primary factor limiting real-world exploitation. No attacker authentication is needed (PR:N), and the sources do not state that any non-default configuration or specific feature must be enabled; the specific vulnerable parameter or endpoint that reflects the input is not described in the available sources. Realistic risk is further bounded by the low-privilege browser-context impact (session/token theft or in-browser actions), not server-side code execution.

This is a medium-severity reflected XSS (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) that reads as a genuine but non-emergency priority. The signals are internally consistent and point to moderate real-world risk: the attack vector is network (AV:N) and requires no attacker authentication (PR:N) with low complexity (AC:L), but the mandatory user interaction (UI:R) - the victim must click an attacker-crafted link - is the dominant limiting factor, keeping this out of the wormable/mass-exploitation tier. The scope change (S:C) and low confidentiality/integrity impact (C:L/I:L, A:N) reflect script execution in the victim's browser context rather than server compromise. No EPSS score, no CISA KEV listing, and no PoC or exploit reference are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; absence of these signals is consistent with a vendor-self-reported web flaw rather than an under-attack vulnerability. The vuln.today decision label is 'this_month,' aligning with a patch-in-normal-cycle urgency rather than act_now/emergency. One data conflict warrants verification: the Description names 'Esri Portal for ArcGIS' as the affected product, yet the patch statement, the CPE (cpe:2.3:a:esri:arcgis_server), and the tags all reference 'ArcGIS Server' - the exact affected component should be confirmed with the Esri security bulletin before scoping remediation.

A remote, unauthenticated attacker crafts a malicious URL pointing at a vulnerable Esri ArcGIS instance with a payload that is reflected unsanitized into the response, then distributes it via phishing or a planted link. When an authenticated or unauthenticated victim clicks it, arbitrary JavaScript executes in their browser in the site's context, enabling session/token theft or actions on the victim's behalf. No public exploit code is identified in the sources, and exploitation depends on the victim clicking the crafted link (UI:R).