CVE-2026-69233

Executive Summary

CVE-2026-69233 is a stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS, affecting versions 11.5 and prior. A remote attacker with administrative privileges can inject malicious JavaScript code that executes in the browser of any victim who views the affected content, leading to unauthorized data access or session hijacking within the ArcGIS Enterprise environment. Organizations running ArcGIS Enterprise 11.1, 11.3, and 11.5 are directly at risk, and no official patch is currently available; the vendor recommends upgrading to the latest long-term support release.

Technical Analysis

This vulnerability belongs to the stored/persistent XSS class (CWE-79), which is characterized by the injection of malicious scripts that are permanently stored on the target server—typically in a database, message forum, visitor log, or comment field—and subsequently served to other users without proper sanitization or output encoding.

Vulnerability Mechanism: The NVD description indicates that a remote attacker with administrative privileges can inject malicious code into the Esri Portal for ArcGIS application. Because the attacker holds administrative privileges, they are able to access configuration interfaces, content management functions, or administrative workflows that accept user-supplied input. When this input is not adequately sanitized upon storage or when it is not properly encoded during output rendering, the injected payload is persisted on the server. Any user who subsequently views the affected page or content will have the malicious script executed in their browser context.

Attack Surface: The attack surface is the administrative interface of Esri Portal for ArcGIS, which is typically exposed to a limited set of trusted users but is often accessible over the network. The CVSS vector confirms a network-based attack vector (AV:N) with low attack complexity (AC:L), indicating that no special conditions beyond having administrative credentials are required to exploit the flaw.

Code-Level Implications: Specific implementation details — such as the exact fields, endpoints, or parameters where the injection occurs — are not disclosed in the CVE description. The vulnerability is best understood at the class level: any administrative functionality that accepts free-form text input (e.g., portal item descriptions, group annotations, custom HTML widgets, or notification messages) and renders it back to users without proper output encoding is a potential injection point.

Scope Considerations: The CVSS vector includes the scope-changed attribute (S:C), meaning that the impact of the vulnerability can cross a security boundary. In this context, the injected script executes in the victim's browser with the victim's privilege level, which could be lower than the attacker's — enabling a privilege-differentiated attack where a lower-privileged user's session is compromised by a higher-privileged attacker.

Authentication and Privilege Requirements: The vulnerability requires high privileges (PR:H) — specifically administrative access. This is a distinguishing feature: unlike typical XSS that requires no authentication or only low privileges, this flaw assumes the attacker already has administrative credentials, which reduces the barrier to exploitation for insiders or compromised admin accounts but limits the attack to a smaller threat actor pool. The absence of user interaction (UI:N) in the CVSS vector indicates that no user action (such as clicking a link) is required for the exploit to trigger — the script executes simply by the victim accessing the stored content.

Exploitation Scenarios

As of this report's publication, there is no public proof-of-concept or confirmed exploit code. The following attack chain is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance and Target Identification: An attacker possessing administrative credentials for Esri Portal for ArcGIS first identifies the target instance. Shodan queries such as portal arcgis esri can locate internet-facing ArcGIS Enterprise deployments. The attacker confirms the version (11.1, 11.3, or 11.5) by examining the portal's login page headers, API responses, or version-specific resource URLs.

Step 2 — Triggering the Flaw: The attacker authenticates to the administrative interface and navigates to a page that accepts stored input — for example, creating a portal item with a malicious description, uploading a custom layer with an embedded HTML payload, or entering JavaScript into an administrative configuration field. Because the attacker has high privileges, they can bypass any role-based restrictions that might otherwise prevent content creation.

Step 3 — Payload Execution: The injected payload is persisted on the server. When another user — possibly a lower-privileged map viewer, a data editor, or another administrator — accesses the affected portal item or page, the server serves the malicious content without proper output encoding. The victim's browser renders the injected JavaScript, which executes in the context of the victim's authenticated session.

Step 4 — Post-Exploitation Impact: Depending on the JavaScript payload, the attacker can:

• Hijack the victim's session token to impersonate them.
• Exfiltrate sensitive GIS data, map layers, or organizational credentials.
• Perform unauthorized actions — such as modifying or deleting portal content — under the victim's identity.
• Capture keystrokes or redirect the user to a credential-harvesting phishing page.

Operational Notes: The attacker's existing administrative privileges mean this is not a privilege-escalation attack; rather, it is a lateral-attack tool that extends the attacker's reach to lower-privileged users' sessions and data. The stored nature of the XSS means the attacker can plant the payload once and trigger it repeatedly across multiple victims over time — a "waterhole" style attack against portal users.

Impact Assessment

CVSS Breakdown (using the provided score of 5.5):

• Attack Vector: Network (AV:N) — The portal is remotely accessible via HTTP(S).
• Attack Complexity: Low (AC:L) — No special conditions or race conditions are required.
• Privileges Required: High (PR:H) — Administrative access is needed to inject the payload.
• User Interaction: None (UI:N) — Victims do not need to click anything; merely viewing the content triggers execution.
• Scope: Changed (S:C) — The impact crosses a security boundary, as the attacker's injected script executes with the victim's privileges, not the attacker's.
• Confidentiality: Low (C:L) — Limited data exposure is possible (e.g., session tokens, partial data exfiltration).
• Integrity: Low (I:L) — Limited ability to modify data as the victim.
• Availability: None (A:N) — The vulnerability does not affect system uptime.

Business Impact: For organizations operating ArcGIS Enterprise, this vulnerability poses a moderate-severity insider-threat risk. Since administrative credentials are already compromised or held by the attacker, the marginal impact of this XSS is the ability to compromise additional accounts and access sensitive geospatial data. GIS portals often store critical business intelligence — land records, infrastructure assets, utility mapping, or defense-related data — which makes data confidentiality the primary concern. The stored nature of the attack also creates a persistent compromise that can evade traditional network-based detection.

Blast Radius: All users of the affected Portal for ArcGIS instances who access the compromised content. This includes both internal organizational users and, in cases where the portal is publicly exposed, external contractors or partners. Because ArcGIS Enterprise 11.1, 11.3, and 11.5 are all affected, any environment running these versions is in scope. No patch is available, so the blast radius is currently open-ended.

Detection Guidance

Sigma Rule

title: Esri Portal for ArcGIS - Stored XSS Payload in Admin Content
id: 8f3c9d2e-4a5b-4c6d-8e7f-1a2b3c4d5e6f
status: experimental
description: Detects suspicious script tags or event handlers in administrative content submissions to Esri Portal for ArcGIS
author: Valtersit Threat Intelligence
date: 2026/06/12
logsource:
    category: web
    product: arcgis
    service: portal
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/sharing/rest/content/'
            - '/home/item.html'
            - '/portaladmin/'
        cs-body|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
            - 'javascript:'
            - '<img src=x'
    condition: selection
level: high
falsepositives:
    - Legitimate admin testing of HTML widgets
    - Custom portal item descriptions containing HTML tags
    - Rare internal development activity
fields:
    - src_ip
    - c-uri
    - cs-username
    - cs-body

YARA Rule

rule Esri_Portal_Stored_XSS_Payloads
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects JavaScript payloads commonly used in stored XSS attacks against Esri Portal for ArcGIS"
        cve = "CVE-2026-69233"
        date = "2026-06-12"
        severity = "high"

    strings:
        $s1 = "<script>" ascii nocase
        $s2 = "fetch(" ascii nocase
        $s3 = "XMLHttpRequest" ascii nocase
        $s4 = "document.cookie" ascii nocase
        $s5 = "onerror=" ascii nocase
        $s6 = "onload=" ascii nocase
        $s7 = "/sharing/rest/" ascii nocase
        $s8 = "esri/request" ascii nocase
        $s9 = "eval(" ascii nocase
        $s10 = "atob(" ascii nocase
        $s11 = "localStorage" ascii nocase
        $s12 = "sessionStorage" ascii nocase

    condition:
        3 of ($s*) and ($s7 or $s8) and uint16(0) == 0x4D5A
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET EXPLOIT Esri Portal for ArcGIS Stored XSS Attempt (CVE-2026-69233)";
    flow:established,to_server;
    http.method; content:"POST";
    http.uri; content:"/sharing/rest/content/";
    http.request_body; content:"<script>";
    http.request_body; content:"onerror";
    http.request_body; content:"document.cookie";
    classtype:web-application-attack;
    sid:2026069201;
    rev:1;
    reference:cve,2026-69233;
    metadata:created_at 2026_06_12;
)

Elastic Detection

// Look for admin POST requests to Portal content endpoints containing XSS payloads
sequence by source.ip with maxspan=1m
  [network where event.action == "connection_established" and destination.port == 443]
  [http where
    http.request.method == "POST" and
    (url.path contains "/sharing/rest/content/" or url.path contains "/home/item.html") and
    wildcard(http.request.body.content, "*<script>*") and
    (wildcard(http.request.body.content, "*onerror*") or wildcard(http.request.body.content, "*document.cookie*")) and
    user.name != null
  ]

Splunk SPL Query

index=web sourcetype=access_combined_w3c
| spath input=body
| search method=POST AND uri_path IN ("/sharing/rest/content/*", "/home/item.html", "/portaladmin/*")
| regex body="(?i)<script[^>]*>"
| regex body="(?i)(onerror|onload|javascript:)"
| eval suspicious_payload=if(match(body, "(?i)document\.cookie|fetch\(|XMLHttpRequest|localStorage"), "high_confidence", "medium_confidence")
| eval attacker_user=username
| table _time, src_ip, dest_ip, uri_path, username, suspicious_payload, body
| sort - _time

Wazuh OSSEC Rule

<group name="arcgis, xss, cve-2026-69233,">
  <rule id="100231" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/sharing/rest/content/</field>
    <field name="method">POST</field>
    <regex>(\<script\>|onerror=|document\.cookie|fetch\()</regex>
    <description>Esri Portal for ArcGIS stored XSS injection attempt (CVE-2026-69233)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_application_attack,</group>
  </rule>

  <rule id="100232" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/home/item.html</field>
    <field name="method">POST</field>
    <regex>(\<script\>|onerror=|onload=)</regex>
    <description>Esri Portal content page - possible stored XSS via item description</description>
    <group>web_application_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: The vendor has not yet released an official patch for CVE-2026-69233. Patch confidence is rated 0/4 (UNPATCHED) based on tracking of all available sources. Esri has issued a general advisory recommending that all users upgrade to the latest long-term support (LTS) release of ArcGIS Enterprise, which may contain the fix.

Immediate Mitigations (to be applied now):

1. Restrict Administrative Access: Limit administrative privileges to a minimal set of trusted users. Implement multi-factor authentication (MFA) for all administrative accounts, as the vulnerability requires high privileges.

2. Network Segmentation: If the Portal for ArcGIS must be accessible externally, place it behind an application-layer firewall (WAF) with rules that block common XSS payload patterns (e.g., <script>, onerror=, event handler attributes) in POST request bodies.

3. Application-Layer Filtering: If your deployment supports reverse-proxy or middleware scripting, add output-encoding or input-filtering rules on the administrative endpoints to sanitize HTML/JavaScript content before persistence.

4. Monitor Administrative Activity: Enable enhanced audit logging for all administrative content operations. Alert on any administrative user who submits content containing JavaScript patterns. Use the detection rules provided above with your existing SIEM/SOAR infrastructure.

5. Review Existing Portal Content: Audit all existing portal items, group descriptions, and custom HTML widgets for embedded scripts or suspicious markup. Remove any content that appears malicious or unintentional.

Patch/Upgrade Steps:

1. Monitor the Esri support site for an official security bulletin and subsequent hotfix.
2. Test and deploy the latest long-term support release of ArcGIS Enterprise when it becomes available.
3. Before upgrading, back up the portal configuration, content database, and GIS service definitions.
4. After upgrade, verify that no regression has occurred in existing map services and applications.
5. If an LTS upgrade is not immediately possible, restrict portal access to trusted internal networks only.

Long-Term Hardening:

1. Principle of Least Privilege: Regularly review and revoke unnecessary administrative accounts on all ArcGIS Enterprise deployments.
2. Input Validation and Output Encoding: Work with your GIS administrators to implement server-side input validation and output encoding within custom portal extensions or widgets.
3. Regular Penetration Testing: Include ArcGIS Portal endpoints in periodic web application security assessments, specifically testing for XSS, injection, and access-control flaws.
4. Patch Management Policy: Align with Esri's security advisory notifications. Define a service-level agreement (SLA) for applying ArcGIS security patches within 30 days of release.
5. Decommission Legacy Versions: Actively plan to retire outdated versions (11.1 and 11.3) to reduce the attack surface.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-69233 — Official NVD vulnerability record with CVSS vector and description.
2. Esri Security Advisory (anticipated): https://www.esri.com/en-us/arcgis/products/arcgis-enterprise — Vendor product page; monitor for a dedicated security bulletin regarding CVE-2026-69233.
3. ArcGIS Enterprise Release Notes: https://support.esri.com/en/releasenotes — Check for LTS release notes that may indicate remediation status.
4. MITRE ATT&CK — T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/ — Context for the attacker tactic most relevant to this flaw.
5. OWASP XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html — Industry-standard guidance for mitigating XSS vulnerabilities.

Threat Actor Activity: No exploitation in the wild or active threat campaigns tied to CVE-2026-69233 have been confirmed to date. CISA has not added this CVE to the Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is not expected to be publicly weaponized in the near term given the administrative privilege requirement; however, the stored XSS mechanism and the value of GIS data in enterprise environments make this a plausible target for targeted insider attacks or compromised-credential scenarios.