CVE-2026-69230

Executive Summary

CVE-2026-69230 is a stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS affecting versions 11.5 and prior. An attacker with administrative privileges can inject malicious code that executes in the browsers of victim users who interact with the compromised portal. The vulnerability carries a CVSS score of 5.5 (Medium) and currently has no confirmed patch, though Esri directs users to upgrade to the latest long-term support release.

Technical Analysis

The vulnerability is classified as CWE-79 (Cross-Site Scripting), specifically a stored XSS variant. Stored XSS occurs when user-supplied input is persisted to the application's data store (e.g., database, configuration file, or content repository) without adequate sanitization or output encoding, and is later rendered in the context of another user's browser session.

In the context of Esri Portal for ArcGIS, the stored XSS vector likely resides in one or more administrative content-management workflows. Portal for ArcGIS is a web-based geospatial content management system where administrators configure portal settings, manage users, create groups, and publish web maps/layers. The vulnerable input could be in fields such as:

• Item descriptions, titles, or metadata for map services, web layers, or applications
• User profile fields (display name, biographical information)
• Group descriptions or custom portal branding/content
• Configuration settings that accept HTML or rich text

Because the attacker requires administrative privileges (PR:H in the CVSS vector), the attack surface is limited to authenticated, high-privilege users. However, the CVSS scope change indicator (S:C) reflects that the injected script executes in a different security context — the victim's browser — even though the injection occurs via the administrative interface.

The attack mechanism at the vulnerability-class level is as follows:

1. An authenticated administrator submits crafted content containing an HTML/JavaScript payload (e.g., <script> or <img onerror> constructs) via an administrative form.
2. The application persists the payload in its underlying storage without properly encoding the output when the content is later rendered.
3. When a victim user (or another administrator) views the affected content, the browser parses the stored payload and executes malicious JavaScript in the context of the Portal for ArcGIS origin.

The CVSS vector details: AV:N (network-accessible), AC:L (no special conditions required for exploitation beyond authentication), PR:H (administrator privileges required), UI:N (no victim interaction needed to trigger the stored payload's display), S:C (scope change — compromised resource affects a different security authority), C:L/I:L (limited confidentiality and integrity impact).

No specific function names, file paths, or endpoint URLs are available in the NVD description. The vulnerability mechanism is described at the vulnerability-class level due to insufficient technical detail in the public advisory.

Exploitation Scenarios

Reconnaissance / Target Identification: The attacker first identifies an Esri Portal for ArcGIS instance exposed to the network. Shodan can be used with queries such as "Portal for ArcGIS" or "Esri ArcGIS Enterprise" to find internet-facing portals. The attacker would then determine the version (11.1, 11.3, 11.5, or earlier) to confirm it is vulnerable (versions ≤ 11.5).

Triggering the Vulnerability: Once the attacker obtains administrative credentials (through privilege escalation, credential theft, social engineering, or insider threat), they authenticate to the portal's administrative interface. The attacker then navigates to a content-creation or configuration workflow — such as creating a new web map, editing an item's description, configuring portal settings, or managing group information.

Payload Execution: The attacker injects a stored XSS payload into one of the vulnerable input fields. The payload can take forms such as:

• <script>malicious payload</script>
• An event handler-based payload: <svg onload="malicious payload">
• An obfuscated or encoded variant to bypass basic filtering

The payload is saved to the portal's storage. When a victim user views the affected content — such as opening a web map, browsing the portal's gallery, or accessing an administrator's profile page — the script executes in the victim's browser with the Portal for ArcGIS origin's privileges.

Post-Exploitation Impact: With the victim's browser session hijacked, the attacker can:

• Steal session cookies/tokens to impersonate the victim
• Access or exfiltrate geospatial data and map layers the victim is authorized to view
• Manipulate portal content (defacement, data modification)
• Conduct further lateral movement by leveraging the victim's privileges
• Establish persistence if the payload survives content refreshes

No public PoC is available; the attack chain is inferred from the stored XSS vulnerability class and the CVSS vector's privilege requirements.

Impact Assessment

The business impact is moderate but non-trivial given the administrative privilege requirement. Key considerations:

1. Affected Systems: Esri Portal for ArcGIS versions 11.1, 11.3, and 11.5 (explicitly called out in the description), plus all prior versions ≤ 11.5. Organizations running ArcGIS Enterprise are specifically named as affected.

2. Blast Radius: The CVSS scope change (S:C) is critical for understanding the blast radius. The injected script operates in the victim's browser context, which may grant access to data and functionality beyond what the attacker's own account can reach. Even though the attacker only needs admin privileges to inject, they can target any user who views the malicious content — including non-privileged users whose session tokens may grant access to sensitive geospatial data.

3. Confidentiality Impact (Low): Script execution can exfiltrate data visible in the victim's browser session, including map layers, feature attributes, and portal configuration data.

4. Integrity Impact (Low): An attacker can manipulate the victim's view of portal content or modify data within the session's authorization scope.

5. Availability Impact (None): The CVSS vector does not include an availability component (A:N), consistent with typical XSS scenarios where service disruption is not a primary objective.

6. Privilege Requirement (High): Only administrators can inject the payload. This substantially reduces the likelihood of automated exploitation and lowers the urgency compared to low-privilege or unauthenticated RCE-style CVEs. However, organizations with compromised admin accounts face a cascading risk.

7. Patch Status: With a patch confidence of 0/4 — UNPATCHED — there is no evidence of a vendor fix from any tracked source. This is a significant concern: the window of exposure is open, and any attacker who obtains admin credentials can exploit this vector without mitigation.

Detection Guidance

Sigma Rule

title: Esri Portal for ArcGIS Stored XSS Injection Attempt
id: 8f2c4d1a-71b5-4e2a-b3c9-a6f0d12e9c5b
status: experimental
description: Detects potential stored XSS payloads in Esri Portal for ArcGIS administrative content submissions
logsource:
  category: webserver
  product: iis
detection:
  selection_portal_path:
    cs-uri-stem|contains:
      - '/portal'
      - '/sharing'
  selection_xss_payloads:
    cs-uri-query|contains:
      - '<script'
      - '<svg'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - '%3Cscript'
      - '%3Csvg'
    sc-status: 200
  condition: selection_portal_path and selection_xss_payloads
level: medium

YARA Rule

rule Esri_Portal_XSS_Stored_Payload
{
    meta:
        author = "Valters IT Security"
        description = "Detects stored XSS payload patterns in Esri Portal for ArcGIS data"
        cve = "CVE-2026-69230"
        date = "2026-01-15"
        severity = "medium"
    strings:
        $a = "Portal for ArcGIS" ascii wide nocase
        $b = "ArcGIS Enterprise" ascii wide nocase
        $xss1 = "<script>" ascii wide nocase
        $xss2 = "<svg onload" ascii wide nocase
        $xss3 = "onerror=" ascii wide nocase
        $xss4 = "javascript:" ascii wide nocase
        $xss5 = "<img" ascii wide nocase
        $xss6 = "document.cookie" ascii wide nocase
        $xss7 = "XMLHttpRequest" ascii wide nocase
    condition:
        ($a or $b) and 2 of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Esri Portal for ArcGIS Stored XSS Payload Attempt (CVE-2026-69230)"; flow:established,to_server; content:"/sharing/rest"; http_uri; content:"<script"; http_client_body; content:"<svg"; http_client_body; pcre:"/(<script|onerror|onload|javascript:)/i"; classtype:web-application-attack; reference:cve,2026-69230; sid:2069230; rev:1;)

Elastic Detection

network where process.name == "w3wp.exe" and
  (url.path contains "/sharing" or url.path contains "/portal") and
  (
    url.query contains "<script" or
    url.query contains "<svg" or
    url.query contains "onerror=" or
    url.query contains "onload=" or
    url.query contains "javascript:" or
    body.content contains "<script" or
    body.content contains "onerror="
  )

Splunk SPL Query

index=web sourcetype=iis OR sourcetype=access_combined
  (uri_path="*/sharing/*" OR uri_path="*/portal/*")
  AND
  (uri_query="*<script*" OR uri_query="*<svg*" OR uri_query="*onerror=*" OR uri_query="*onload=*" OR uri_query="*javascript:*")
  OR
  (_raw="*<script>*" OR _raw="*<svg onload*" OR _raw="*onerror=*")
  AND uri_path="*/sharing/*"
| stats count by src_ip, uri, clientip, useragent
| where count > 1

Wazuh OSSEC Rule

<rule id="106230" level="10">
  <decoded_as>web</decoded_as>
  <match>Portal for ArcGIS|ArcGIS Enterprise|portal</match>
  <regex>(\<script|\<svg|onerror=|onload=|javascript:)</regex>
  <description>CVE-2026-69230: Esri Portal for ArcGIS Stored XSS Payload Detected</description>
  <group>web_application_attack,xss,cve-2026-69230,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source has been identified.

This is the highest-priority concern. With no verified vendor patch and patch confidence at zero, the following layered approach must be implemented:

1. Immediate Mitigations

• Restrict administrative access to the Portal for ArcGIS. Implement strict network access control lists (ACLs) that limit admin interface access to trusted IP ranges only.
• Enforce multi-factor authentication (MFA) for all administrative accounts to reduce the risk of admin credential compromise.
• Implement Web Application Firewall (WAF) rules to filter/strip scripts and event handler attributes from POST bodies sent to the portal's administrative endpoints.
• If feasible, deploy a caching proxy with input sanitization to strip raw HTML/JavaScript from content submitted via the portal interface.
• Review administrative activity logs for anomalous content-submission patterns, especially by recently-created or recently-compromised admin accounts.
• Limit employee access to the portal via browser extension policy (CSP headers can help mitigate — check if Portal for ArcGIS supports Content-Security-Policy header configuration).

2. Patch / Upgrade Steps

• Esri has not released a confirmed patch as of this report. The vendor states that all users should "upgrade to the latest long-term support release."
• Monitor Esri's official security advisory channel and Esri Community forums for announcements regarding CVE-2026-69230.
• Plan a maintenance window within the next 1–2 quarters to upgrade to the latest long-term support (LTS) release of ArcGIS Enterprise, as the description explicitly names versions 11.1, 11.3, and 11.5 as affected.
• Before upgrading, take full configuration and content backups of the Portal for ArcGIS instance.

3. Long-Term Hardening

• Establish a formal patch-management program that subscribes to Esri security advisories and applies updates within 30 days of release.
• Enforce the principle of least privilege: review all administrative accounts and revoke where not strictly needed.
• Implement network segmentation so that the Portal for ArcGIS is segregated from other enterprise systems.
• Conduct regular security reviews of custom portal content to identify and remove any embedded scripts.
• Deploy a CSP header on the portal if supported, with script-src 'self' to restrict inline script execution.
• Enable comprehensive audit logging on the portal and retain logs for at least 90 days for forensic analysis.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-69230
2. Esri Security Advisory (withheld pending patch availability — monitor https://www.esri.com/en-us/arcgis/products/security-advisories)
3. Esri Community/Support Forum: https://community.esri.com (search "Portal for ArcGIS security advisory")
4. CWE-79 (Cross-Site Scripting) Reference: https://cwe.mitre.org/data/definitions/79.html

Threat Actor Campaign Notes: No evidence of in-the-wild exploitation has been reported, and the CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code or Nuclei template exists. The attack requires administrative privileges, which significantly reduces the likelihood of widespread automated exploitation. However, state-sponsored actors targeting geospatial intelligence organizations may view this as an attractive vector for stealthy data exfiltration from compromised admin accounts.