CVE-2026-69232

Executive Summary

CVE-2026-69232 is a stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.5 and prior. It allows a remote, privileged ("high privilege") attacker to persist malicious JavaScript that executes in a victim user's browser when the affected content is rendered. The vulnerability is scored CVSS 3.1 base 5.5, reflecting a scope change (S:C) with low confidentiality and integrity impact (C:L/I:L), no availability impact, and no privileges to the victim beyond browsing the portal.

Technical Analysis

The vulnerability class is CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The suffix "stored" describes the persistence model: attacker-supplied input is retained by the Portal for ArcGIS application and, on a later request, embedded into an HTML response without adequate output encoding or sanitization. When a victim's browser renders that response, the injected markup and script are interpreted in the security context of the Portal origin.

Key properties derived from the supplied data:

• Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N. AV:N indicates the vulnerable component is reachable over a network — here, the Portal for ArcGIS web interface. AC:L indicates no special preconditions beyond the attacker's own valid privileged access. PR:H indicates the attacker must already hold an elevated/privileged role within the portal; this is not an unauthenticated exploit and the attacker's own account is the delivery vehicle. UI:N indicates the XSS executes without requiring the victim to click a crafted link — consistent with a stored payload in a web page the victim loads as part of normal portal use (the mere act of visiting the affected page satisfies triggering). S:C means a successful exploit crosses a security boundary — script executes in the browser origin context, impacting resources beyond the vulnerable component itself. C:L/I:L reflect limited read and limited write impact in that browser context; A:N indicates no availability impact.

The specific portal feature, endpoint, parameter, storage location, and rendering sink are NOT described in the NVD text. No function names, URL paths, request parameters, or stored field names are given. Accordingly, the exact injection point cannot be stated without fabrication; the analysis remains at the vulnerability-class level.

Because the attacker must be privileged (PR:H), this is best characterized as a privileged-user-to-victim escalation inside the portal web tier: an account able to author or edit stored portal content can plant a script that runs for other portal users, including potentially higher-privileged administrators who view that content. Scope change (S:C) is the material risk driver rather than raw impact subscores.

Exploitation Scenarios

The attack chain, inferred from the CWE-79 / stored-XSS class and the CNA/NVD text only. No public PoC code, Nuclei template, or exploit script is known — PoC status "Public" refers to general public discussion/reporting of the issue, and the exploit code flag is NO. The steps below are therefore class-level and deliberately avoid naming endpoints or parameters that were not provided.

1. Reconnaissance / target identification. The attacker identifies an internet-facing or internally reachable Esri Portal for ArcGIS deployment running version 11.5 or earlier. Discovery is straightforward: portals present distinctive login and web-map content and are commonly enumerated via internet scanning using Esri/ArcGIS product fingerprints. The attacker also needs — or must obtain — a privileged portal account (PR:H), for example an account able to create or modify content in the portal's application tier.

2. Triggering the flaw. The attacker, using the privileged account, supplies crafted content into a stored field or object within the portal. Because output encoding is missing when that content is subsequently rendered, the payload becomes persistent content in the portal's web tier. This stage corresponds directly to CWE-79: input is accepted and stored without neutralization, and later written into a generated page.

3. Payload/execution. When any victim user — including a portal administrator — loads the page that renders the stored content, the browser executes the injected JavaScript in the origin of the Portal for ArcGIS instance. No crafted victim link is required (UI:N); normal navigation to the affected page is sufficient. Execution occurs in the victim's browser session context, which is what produces the scope change (S:C).

4. Post-exploitation impact. In the victim's authenticated browser context, the attacker's script can read and act on content and requests belonging to that session, enabling limited confidentiality and integrity impact (C:L/I:L) — for example capture of in-application data visible to the victim and unauthorized actions issued as the victim. Availability is unaffected (A:N). Persistence is a property of the stored payload: it re-fires for each user loading the affected content until removed, and it can be leveraged to target higher-privileged portal users than the attacker's own account.

Constraint: absent a specific vulnerable feature, endpoint, or storage field from the advisory data, no attacker payload string, no request format, and no exact rendering page can be asserted. Any such details in circulation should be treated as unverified.

Impact Assessment

Business impact centers on the integrity and confidentiality of the Portal for ArcGIS web tier and the sessions of portal users. Because the vulnerability is stored and cross-site in nature, a single privileged authoring account can reach every user who views the affected content, including administrators — an insider-or-compromised-privileged-account risk with lateral phishing/session-abuse potential inside the GIS platform.

Subscores: AV:N (remote), AC:L (no complex preconditions), PR:H (attacker needs elevated privileges — the principal limiting factor), UI:N (victim action beyond viewing the page is not required), S:C (impact extends beyond the vulnerable component to the browser origin). The base score of 5.5 reflects that privileged prerequisite and the low C/I subscores; the scope change elevates it relative to a similarly scored in-scope XSS.

Blast radius: all users of an affected portal 11.5 or prior who load the poisoned content, with the highest risk to those in administrative roles. Affected deployment categories per the advisory: ArcGIS Enterprise 11.1, 11.3, and 11.5. EPSS is 0.00238 (14.8th percentile), indicating low modeled short-term exploitation likelihood; CISA KEV status is NO, so there is no confirmed exploitation-in-the-wild at the time of writing.

Detection Guidance

Sigma Rule

title: Potential Stored XSS Payload Injection in Esri Portal for ArcGIS
id: 4b7c9d21-8f3a-4e6b-9c1d-2a5f7e0b8c34
status: experimental
description: Detects script/event-handler or javascript: payload patterns submitted to a Portal for ArcGIS web tier, consistent with stored XSS (CWE-79, CVE-2026-69232).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-69232
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1059.007
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
      - PATCH
  selection_payload:
    - 'cs-uri-query|contains':
        - '<script'
        - 'javascript:'
        - 'onerror='
        - 'onload='
        - 'onmouseover='
        - 'document.cookie'
        - 'String.fromCharCode'
        - '<svg'
        - '<img src=x'
  selection_referer:
    cs-referer|contains: '/arcgis/'
  condition: selection_method and selection_payload and selection_referer
falsepositives:
  - Legitimate rich-text or HTML content authored by trusted portal administrators
  - Security scanning of the portal by authorized testers
level: medium

YARA Rule

rule CVE_2026_69232_Portal_ArcGIS_Stored_XSS
{
    meta:
        description = "Detects common stored-XSS payload markers associated with CVE-2026-69232 in Esri Portal for ArcGIS content or logs"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-69232"
        cve         = "CVE-2026-69232"
        cwe         = "CWE-79"
        author      = "valtersit.com"
        date        = "2026-01-01"

    strings:
        $s1 = "<script" nocase ascii
        $s2 = "javascript:" nocase ascii
        $s3 = "onerror=" nocase ascii
        $s4 = "onload=" nocase ascii
        $s5 = "document.cookie" nocase ascii
        $s6 = "String.fromCharCode" nocase ascii
        $s7 = "window.location" nocase ascii
        $s8 = "<svg/onload" nocase ascii
        $arcgis = "arcgis" nocase ascii

    condition:
        $arcgis and any of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-69232 Esri Portal for ArcGIS Stored XSS Payload Attempt"; flow:established,to_server; http.method; content:"POST"; http.header; content:"/arcgis/"; nocase; http.request_body; content:"<script"; nocase; http.request_body; content:"javascript:"; nocase; http.request_body; content:"document.cookie"; nocase; threshold:type limit, track by_src, count 5, seconds 60; classtype:web-application-attack; reference:cve,2026-69232; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-69232; sid:6923201; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [http where http.request.method in ("POST","PUT","PATCH") and
           url.path contains "/arcgis/" and
           http.request.body.content regex~ ".*(onerror=|onload=|javascript:|<script|document\\.cookie).*"]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=esri:portal
| eval body=coalesce(request_body, form_data, body, uri_query)
| where match(body, "(?i)(<script|javascript:|onerror=|onload=|onmouseover=|document\.cookie|String\.fromCharCode)")
| rex field=uri_path "(?<portal_prefix>.*?/arcgis/)"
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources by uri_path, portal_prefix, user
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,esri,arcgis,xss,">
  <rule id="692321" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/arcgis/</field>
    <regex type="pcre2">(?i)(%3Cscript|&lt;script|<script|javascript:|onerror=|onload=|document\.cookie|String\.fromCharCode)</regex>
    <description>CVE-2026-69232: Possible stored XSS payload submitted to Esri Portal for ArcGIS</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>web_attack,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The available data states only that users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch and that all users should upgrade to the latest long-term support release. No CVE-specific fixed version string, vendor advisory number, or KB identifier is provided in this dataset — verify the fixed build directly with Esri Support before relying on any specific patch level.

1. Immediate mitigations

• Upgrade ArcGIS Enterprise to the latest long-term support release as directed by the advisory; treat 11.5 and prior as affected.
• Until upgraded, restrict portal authoring/editing privileges to the minimum necessary accounts and review the membership of privileged portal roles (PR:H means a privileged account is required to plant the payload).
• Where feasible, place the portal behind an authenticating reverse proxy or WAF configured to inspect and block script/event-handler markup in request bodies to portal content endpoints.
• Apply Content-Security-Policy and HttpOnly/Secure cookie attributes at the reverse-proxy/gateway layer to limit executed script's ability to reach session material (recall C:L/I:L with S:C).
• Review and remove any pre-existing suspicious stored content in portal authoring areas that render HTML.

2. Patch/upgrade steps

• Confirm current version of Portal for ArcGIS / ArcGIS Enterprise (affected: 11.5 and prior; 11.1, 11.3, 11.5 explicitly called out).
• Back up portal content and configuration before upgrading.
• Follow Esri's documented ArcGIS Enterprise upgrade procedure to the latest LTS release; patch confidence is only CLAIMED, so validate the fix (e.g., re-test controlled stored-content rendering) after upgrading.
• Re-verify all components (Portal, GIS Server, Data Store, Web Adaptor) are on supported versions, since the fix may require a coordinated upgrade.

3. Long-term hardening

• Enforce least privilege on portal roles; separate content-authoring from administrative roles.
• Adopt an input-validation and output-encoding review process for any portal customization that renders user- or admin-supplied HTML.
• Deploy and tune WAF/CSP protections and monitor the detection rules in this report.
• Maintain an asset inventory of internet-facing ArcGIS portals for rapid impact assessment when Esri advisories publish.
• Track Esri advisories and CISA KEV; note that CVE-2026-69232 is NOT currently in KEV, but stored XSS in a privileged authoring context can be chained with other issues.

References

• NVD — CVE-2026-69232: https://nvd.nist.gov/vuln/detail/CVE-2026-69232
• MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1059.007 — Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/
• Esri ArcGIS Enterprise support and release information: https://support.esri.com/ (consult the vendor's security advisory and product lifecycle pages for the current long-term support release)
• CISA Known Exploited Vulnerabilities catalog (status check — CVE-2026-69232 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild note: No threat actor campaign, exploitation-in-the-wild evidence, public exploit code, or Nuclei template is associated with CVE-2026-69232 in the provided data. EPSS 0.00238 (14.8th percentile) and KEV = NO indicate low modeled and no confirmed active exploitation; treat accordingly and prioritize based on exposure of privileged portal accounts.