CVE-2026-69229

Executive Summary

CVE-2026-69229 is an HTML injection vulnerability affecting Esri Portal for ArcGIS versions 12.0 and prior. A remote, authenticated attacker can inject arbitrary HTML into the Portal for ArcGIS Home application, leading to potential content spoofing, credential harvesting, or phishing campaigns against enterprise users. Esri recommends all users of ArcGIS Enterprise 11.1, 11.3, 11.5, and 12.0 to upgrade to the latest long-term support release; however, no specific patch version has been publicly identified.

Technical Analysis

CVE-2026-69229 is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating a cross-site scripting (XSS) class vulnerability. However, the NVD description specifically characterizes the flaw as an HTML injection vulnerability rather than a classic stored/reflected XSS. The distinction is important: HTML injection allows an attacker to inject arbitrary HTML markup into a rendered page context, which may enable content spoofing and phishing but does not necessarily execute JavaScript in the victim's browser context (though in many practical cases, HTML injection can be escalated to script execution if the injection context permits tag/attribute injection).

The vulnerability exists in the Portal for ArcGIS Home application, which is the primary web interface component of ArcGIS Enterprise deployments. The "Home" application is typically the landing page that authenticated users access to search for maps, data, and services. The attack requires authentication (CVSS: PR:L — Low Privilege), meaning the attacker must have an account on the Portal. This could be a legitimate but low-privileged user (e.g., a data viewer or editor role) rather than an administrator.

The injection vector is not described in technical detail in the NVD entry. Based on the vulnerability class and the affected component (a web mapping portal), the injection likely occurs in a user-controlled field that is subsequently rendered without proper HTML sanitization. Candidate fields in a typical GIS portal include: map/item titles, descriptions, metadata fields, user profile fields, or group names. When other users view these fields in the Home application, the injected HTML is rendered in their browser.

The CVSS vector reflects the following characteristics:

• AV:N — Network exploitable (the Portal is network-accessible)
• AC:L — Low attack complexity (no special conditions required)
• PR:L — Low privileges required (authenticated user needed)
• UI:N — No user interaction required (the victim does not need to click anything beyond viewing the page)
• S:U — Unchanged scope (the injection stays within the Portal application)
• C:L/I:L — Low confidentiality and integrity impact; no availability impact

The lack of a public patch (patch confidence 0/4) and the absence of EPSS scoring indicate this is a recently disclosed vulnerability with no verified remediation path available as of this writing.

Exploitation Scenarios

Based strictly on the NVD description, the following attack chain is mapped (adjusted for the vulnerability class; no public PoC exists):

Step 1 — Reconnaissance/Target Identification: The attacker first identifies an Esri Portal for ArcGIS instance. This can be done via Shodan/Censys searches for "Portal for ArcGIS" or "ArcGIS Enterprise" banners, or by scanning for the default portal path on known web servers. The attacker then enumerates the portal for valid user accounts. If the portal has weak password policies, default accounts, or previously leaked credentials, the attacker may gain access through credential stuffing.

Step 2 — Triggering the Flaw: The attacker logs into the portal with the low-privileged account and navigates to a feature that accepts user-supplied content — e.g., creating an item, updating metadata, or editing a profile field. The attacker inserts a crafted HTML payload into the input field. Because the portal application fails to sanitize this input before rendering it in the Home application, the payload is stored and subsequently served to other users who view that content.

Step 3 — Payload/Execution Method (vulnerability class level): The payload consists of HTML markup — for example, <iframe>, <img> with external sources, or crafted <form> elements — designed to spoof legitimate application content. Since this is HTML injection (CWE-79 family), the attacker could:

• Insert a fake login form to harvest credentials of other users
• Overlay a phishing message or alert that directs users to external malicious sites
• Inject images/trackers that leak viewer IP addresses or browser information
• In some contexts, escalate to script execution if the injected HTML permits event handler attributes (e.g., <img onerror=...>), though this depends on the specific rendering context

Step 4 — Post-Exploitation Impact: If the attacker successfully steals credentials of higher-privileged users (administrators), they could gain administrative access to the Portal for ArcGIS, which would allow: modification/removal of critical GIS data layers, mapping services, and organization memberships. In an enterprise context, this could disrupt operational workflows that depend on the GIS infrastructure (public safety, utility management, urban planning). The CVSS impact rating (C:L/I:L) reflects a moderate impact level, but the scale of the organization and the sensitivity of the GIS data stored within ArcGIS Enterprise could elevate the real-world significance.

Note: No public PoC or exploit code has been reported. The attack chain above is inferred from the vulnerability class and the affected component's typical functionality.

Impact Assessment

Business Impact: The Portal for ArcGIS is the central web interface for ArcGIS Enterprise deployments. HTML injection that affects the Home application directly undermines the trust users place in the portal as an official organizational resource. An attacker who can inject HTML into this application can:

• Conduct targeted phishing campaigns against internal staff, potentially harvesting Active Directory or enterprise credentials
• Deface organizational content, damaging brand reputation and user confidence
• Exfiltrate limited sensitive information (CVSS confidentiality impact: Low) — e.g., user email addresses, IP addresses, or metadata displayed on the page

Affected Systems: ArcGIS Enterprise versions 11.1, 11.3, 11.5, and 12.0 (as explicitly listed in the advisory). The vendor also states "Portal for ArcGIS versions 12.0 and prior" in the NVD description, which encompasses early versions as well.

Blast Radius: The vulnerability requires authentication, which significantly reduces the external attack surface — an external unauthenticated attacker cannot exploit this directly. The primary blast radius is within an enterprise: any authenticated user of the portal can potentially attack other users. In large organizations with thousands of portal users, the potential victim pool is substantial. However, the scope is unchanged (S:U), meaning the injected content stays within the Portal application and does not affect other organizational services.

CVSS Subscore Analysis: The overall score of 5.4 (Medium) reflects the combination of network exploitability with the authentication requirement. The availability impact being N (none) means this cannot be leveraged directly for denial-of-service. The confidentiality and integrity impacts (both Low) are consistent with an injection vulnerability that does not directly expose sensitive data but degrades the integrity of web content.

Detection Guidance

Sigma Rule

title: Detecting HTML Injection Attempts against Esri Portal for ArcGIS
id: 046f0f9a-2c7e-4b5d-8f2e-7a6b8d1c3e5f
status: experimental
description: Detects potential HTML injection payloads in requests to Portal for ArcGIS applications
author: Valtersit Threat Intelligence
date: 2026-02-15
logsource:
  category: webserver
  product: iis
  service: http
detection:
  selection_uri:
    cs-uri-stem:
      - '*/home/*'
      - '*/sharing/*'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '<iframe'
      - '<img'
      - 'onerror='
      - 'javascript:'
      - '<svg'
  condition: selection_uri and selection_payload
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate administrative use of HTML in map descriptions
  - Authorized content management operations
level: medium

YARA Rule

rule Esri_Portal_HTML_Injection
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detect HTML injection payloads associated with CVE-2026-69229 in web logs or HTTP payloads"
        cve = "CVE-2026-69229"
        date = "2026-02-15"
        severity = "medium"
    strings:
        $s1 = "<iframe" ascii nocase
        $s2 = "<script" ascii nocase
        $s3 = "onerror=" ascii nocase
        $s4 = "javascript:" ascii nocase
        $s5 = "/home/" ascii nocase
        $s6 = "sharing/rest" ascii nocase
        $s7 = "onload=" ascii nocase
        $s8 = "onmouseover=" ascii nocase
    condition:
        (uint16(0) == 0x0D0A or filesize > 100) and
        2 of ($s1, $s2, $s3, $s4, $s7, $s8) and
        (2 of ($s1, $s2, $s3, $s4, $s7, $s8) and any of ($s5, $s6))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET TROJAN Esri Portal for ArcGIS HTML Injection Attempt (CVE-2026-69229)";
    flow:established,to_server;
    content:"/home/"; http_uri; nocase;
    content:"<iframe"; http_uri; nocase;
    sid:20269229;
    rev:1;
    metadata:created_at 2026_02_15, updated_at 2026_02_15, cve CVE-2026-69229;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-69229;
    classtype:web-application-attack;
)

Elastic Detection

// Detect HTTP requests with HTML injection patterns to Portal for ArcGIS endpoints
where process.name == "httpd.exe" or process.name == "w3wp.exe"
// Alternative for proxy/access logs indexed in Elasticsearch:
// filter for url.path containing "/home/" and url.query containing suspicious tags

// EQL for web access logs (ECS format):
sequence by host.name
  [ any where url.path like "*home*" and (
      url.query like "*<script>*" or
      url.query like "*<iframe>*" or
      url.query like "*onerror=*" or
      url.query like "*javascript:*"
    )
  ]
  [ any where url.path like "*home*" and (
      url.query like "*<img*" or
      url.query like "*<svg*" or
      url.query like "*onload=*"
    )
  ]

Splunk SPL Query

index=web sourcetype=iis:log OR sourcetype=access_combined
| where match(uri_path, "(?i)/home/")
| search uri_query IN ("*<script*", "*<iframe*", "*onerror=*", "*javascript:*", "*<img*", "*onload=*")
| table _time, clientip, user, uri_path, uri_query, status
| eval action = "investigate_html_injection"
| sort - _time

Wazuh OSSEC Rule

<group name="esri_portal,">
  <rule id="336460" level="10">
    <if_sid>31122</if_sid>  <!-- Web server 400 error log -->
    <regex>(?i)/home/</regex>
    <regex>(?i)(&lt;script|&lt;iframe|onerror=|javascript:|&lt;img)</regex>
    <description>CVE-2026-69229: HTML injection payload detected in Esri Portal for ArcGIS request path</description>
    <group>web_application_attack,pci_dss_6.5.1,gdpr_32,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No official patch version has been publicly identified. The NVD description instructs users to "upgrade to the latest long-term support release," but does not specify a patched version number.

1. Immediate Mitigations (until a patch is available):

• Restrict portal access: Limit the Portal for ArcGIS Home application to trusted networks only; enforce VPN or network segmentation so untrusted external users cannot reach the portal.
• Enforce strong authentication policies: Since the vulnerability requires authentication, enforce MFA on all portal accounts to reduce the likelihood of credential compromise that could be used to inject HTML.
• Review user roles and permissions: Audit all portal users and reduce role privileges to the minimum necessary. Disable or remove dormant accounts.
• Enable web application firewall (WAF) rules: Deploy WAF rules that block common HTML injection payloads (e.g., <script>, <iframe>, event handler attributes) in requests to the /home/ path.
• Monitor portal logs: Increase vigilance on logs for access to the Home application, paying attention to requests containing unusual parameters or HTML tags.

2. Patch/Upgrade Steps:

• Monitor Esri's official security advisories (https://www.esri.com) for a patch release for Portal for ArcGIS.
• Subscribe to Esri's security notification mailing list to receive updates when a fix is available.
• When a patched version is released, plan an upgrade of all affected ArcGIS Enterprise deployments (11.1, 11.3, 11.5, and 12.0) during a maintenance window. Test the upgrade in a staging environment first.
• If feasible, upgrade to the latest long-term support (LTS) release of ArcGIS Enterprise as recommended by the vendor.

3. Long-Term Hardening:

• Adopt secure coding practices: For any custom extensions to the Portal, enforce output encoding and input sanitization in web application code.
• Conduct regular security assessments: Perform periodic penetration testing and source code review of the Portal deployment configuration.
• Implement robust logging and SIEM correlation: Ensure that portal access logs are integrated into the organization's SIEM for real-time detection of injection attempts.
• Enable Content Security Policy (CSP): If the Portal allows configuration of HTTP response headers, implement a strict CSP to reduce the impact of HTML injection and XSS.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-69229 — Official NVD CVE record with CVSS vector and description.
2. Esri Security Advisory: Monitor https://www.esri.com/en-us/arcgis/products/arcgis-enterprise/overview for security notifications (advisory may be published after patch release).
3. CWE-79 Reference: https://cwe.mitre.org/data/definitions/79.html — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
4. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application technique.

Known Threat Actor Campaigns: No threat actor campaigns or exploit-in-the-wild evidence has been identified for this CVE at the time of writing. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

PoC Status: None publicly available. No Nuclei template or exploit code has been detected.

Report generated by Valtersit Threat Intelligence. This report should be reassessed upon release of an official Esri patch, as the vulnerability status, mitigation strategy, and detection rules may need revision.