CVE-2026-69235 — Stored Cross-Site Scripting in Esri Portal for ArcGIS

Executive Summary

CVE-2026-69235 is a stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS, affecting versions 11.5 and prior, including ArcGIS Enterprise 11.1, 11.3, and 11.5. A remote, privileged attacker can exploit this flaw to inject malicious code that executes in a victim’s browser, potentially leading to session hijacking, data theft, or lateral movement within the GIS management plane. The vulnerability carries a CVSS score of 6.1 (Medium) and is currently unpatched, with no vendor fix or workaround publicly available.

Technical Analysis

Based on the NVD description, CVE-2026-69235 is classified as a stored (persistent) XSS flaw (CWE-79) present in Esri Portal for ArcGIS versions 11.5 and prior. The vulnerability resides in user-supplied content that is stored server-side and later rendered in the browsers of other users, enabling malicious script execution in the context of the affected Portal application.

Attack mechanism at class level: Stored XSS occurs when an application accepts user input, persists it to a data store (e.g., database, file system, content repository), and later reflects that content into an HTML page without proper sanitization or output encoding. In this instance, the stored content is likely related to portal configuration elements, user profiles, feature service metadata, or map/application definitions — all of which are centrally administered and rendered to other authenticated users.

Attack surface: The attack vector is network-based (AV:N) with low complexity (AC:L), requiring no prior authentication (PR:N) per the CVSS vector; however, the NVD description explicitly states the attacker must be privileged, indicating authenticated access with elevated roles (e.g., portal administrator, publisher, or content manager) is required to author the malicious payload. The interaction requirement (UI:R) implies the victim must open the malicious content (e.g., a map service page, dashboard, or item detail view) in their browser.

Scope considerations: The CVSS scope is changed (S:C), indicating the exploited component (Portal for ArcGIS itself) is compromised beyond the vulnerable code's trust boundary. This is significant in an ArcGIS Enterprise deployment, where the portal is tightly integrated with ArcGIS Server federated services, the web adaptor, and underlying identity providers.

Technical specifics: The NVD description does not disclose the exact vulnerable parameter, endpoint, or code path. Insufficient technical detail is available to pinpoint the precise input field or transformation function that permits script injection. The absence of a CNA title further limits context. Analysts should consider that Esri's portal software has historically relied on configurable "proxies," "web adaptors," and "credential stores" — any of which could be the injection point — but this remains speculation.

Patch status: No patch evidence exists from any tracked source (patch confidence 0/4). The vendor advisory explicitly encourages patching and upgrading to the latest long-term support release, indicating active remediation is expected but not yet delivered.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available. The attack chain described below is inferred from the vulnerability class (stored XSS) and the CVSS vector; it is intended as a technical approximation.

Step 1 — Reconnaissance and target identification: An attacker with legitimate portal credentials (e.g., a low-privileged user able to create content, or a compromised privileged account) identifies an ArcGIS Enterprise instance exposed to the Internet or reachable within a corporate network. Shodan-style searches for "Portal for ArcGIS" or the portal's default HTTPS web access point (typically via a web adaptor, such as a URL containing /arcgis/home) would reveal candidates. The attacker enumerates portal item types that support user-defined content — such as web maps, web mapping applications, feature layers, or metadata descriptions — to identify injection surfaces.

Step 2 — Flaw class trigger: The attacker crafts a payload containing malicious JavaScript (e.g., <script>alert(document.cookie)</script> or an encoded variant) and submits it through a legitimate portal content-creation workflow. The application persists the payload into its content store without adequate output encoding or sanitization. Because the flaw is stored, the payload remains dormant until rendered by another user.

Step 3 — Payload execution: A victim — another portal user, potentially an administrator — browses to the item that contains the malicious content (e.g., opens a dashboard, map viewer, or item details page). The victim's browser processes the stored data, and the injected JavaScript executes in the context of the portal's origin. Given the XSS is reflected in a privileged application, the script runs with the victim's session, enabling it to read cookies, capture keystrokes, forge requests, or manipulate DOM elements.

Step 4 — Post-exploitation impact: The attacker, using the victim's session token, can perform actions as the victim. If the victim is an administrator, the attacker gains portal administrative privileges: creating new users, modifying security settings, disabling federated services, or exfiltrating GIS data. The CVSS confidentiality and integrity impact (both rated Low) reflect the partial data disclosure and limited data modification that typically result from an XSS in a web application, but in a GIS context, even "low" integrity impacts can corrupt authoritative map data, military operations graphics, or infrastructure documentation — cascading into operational disruption.

Impact Assessment

Business impact: Esri Portal for ArcGIS is the central governance hub for an organization's geospatial data and services. Stored XSS compromises trust in that hub: an attacker can steal session tokens, impersonate users, and manipulate displayed GIS content. The CVSS score of 6.1 reflects Medium severity, but the availability of the portal is not directly impacted (no availability score in the vector). The real-world severity depends on deployment context: government agencies using ArcGIS for emergency response, utilities mapping critical infrastructure, or defense organizations handling classified geospatial data face higher risk than a small municipal planning office.

Affected systems: ArcGIS Enterprise 11.1, 11.3, and 11.5 are explicitly called out; the description states "versions 11.5 and prior," meaning all older releases (10.x, 11.0, 11.2, 11.4) are presumed vulnerable. Esri's own guidance is to patch to the latest long-term support release, which aligns with Esri's lifecycle model.

Blast radius: Because the CVSS scope is "changed" (S:C), the compromise extends beyond the vulnerable component. An attacker who can get a privileged user to execute script could pivot to the underlying ArcGIS Server, the organization's Active Directory, or other federated identity sources. The blast radius is thus the entire ArcGIS Enterprise deployment, not merely the portal web application.

CVSS subscores: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N breaks down as:

• Attack Vector: Network (exploitable remotely)
• Attack Complexity: Low (no special conditions required)
• Privileges Required: None (but NVD text notes privileged attacker — see caveat below)
• User Interaction: Required (victim must click/open)
• Scope: Changed (impact in a different security context)
• Confidentiality: Low (limited data disclosure)
• Integrity: Low (limited data modification)
• Availability: None (no denial of service)

Caveat: The CVSS PR:N conflicts with the NVD description's "privileged attacker" language. This discrepancy suggests the CVSS was scored for the generic class (any user can be tricked), while the description narrows the actual exploit requirement to an authenticated privileged account. Analysts should treat the threat as requiring authenticated access, despite the lower PR score.

Detection Guidance

The following detection artifacts are generalized for stored XSS in a web application like Portal for ArcGIS. Since the precise injection point is unknown, these rules target the broader XSS attack class and the known payload patterns associated with it.

Sigma Rule

title: Potential Stored XSS Payload in Portal for ArcGIS Content
id: 4c1bd8a0-9f3c-4f2e-8e5a-3b2d7c9e1f6a
status: experimental
description: Detects known XSS payload patterns in HTTP requests or logs that may indicate an attempted stored XSS injection against Esri Portal for ArcGIS.
author: vartersit.com
logsource:
  category: webserver
  product: arcgis
detection:
  selection_xss_strings:
    - 'script>'
    - '<img'
    - 'onerror='
    - 'onload='
    - 'javascript:'
    - 'document.cookie'
    - 'alert('
  selection_paths:
    - '*arcgis*'
  condition: selection_xss_strings and selection_paths
level: high
falsepositives:
  - Legitimate GIS content that contains HTML/JS for interactive maps (rare)
  - Security scanners performing XSS checks
tags:
  - attack.t1059.007
  - cve-2026-69235

YARA Rule

rule CVE_2026_69235_ArcGIS_StoredXSS
{
    meta:
        author = "valtersit.com"
        description = "Detects payload patterns consistent with stored XSS in Esri Portal for ArcGIS"
        cve = "CVE-2026-69235"
        severity = "medium"
        date = "2026-02-01"
    strings:
        $s1 = "<script>" ascii nocase
        $s2 = "onerror=" ascii nocase
        $s3 = "onload=" ascii nocase
        $s4 = "javascript:" ascii nocase
        $s5 = "document.cookie" ascii nocase
        $s6 = "<img src=" ascii nocase
        $s7 = ".arcgis." ascii nocase
        $s8 = "portal" ascii nocase
    condition:
        any of ($s1, $s2, $s3, $s4, $s5, $s6) and any of ($s7, $s8) and filesize < 2MB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-69235 Potential Stored XSS in Portal for ArcGIS"; flow:established,to_server; content:"<script>"; http_client_body; nocase; content:"arcgis"; http_uri; nocase; content:"portal"; http_uri; nocase; threshold:type limit, track by_src, count 1, seconds 60; reference:cve,CVE-2026-69235; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-69235; sid:10069235; rev:1;)

Note: This rule inspects the request body for script tags within requests to portal endpoints. It generates noise with security scanners and legitimate map applications; position as alert-only in production.

Elastic Detection

// Detect HTTP requests to ArcGIS Portal containing JS payload indicators
any where process.name == "java" or process.name == "nginx" or process.name == "httpd" or true
  and (
    // Look for XSS payloads in request bodies or URLs
    url.path : "*arcgis*" and (
        request.body : "*<script>*" or 
        request.body : "*onerror=*" or 
        request.body : "*javascript:*" or 
        url.query : "*document.cookie*" or
        url.query : "*alert(*"
    )
  )
  and not (source.ip is private and destination.port in (80, 443) and request.referrer : "*esri*")

Splunk SPL Query

index=web sourcetype=access_combined 
| where match(uri_path, "(?i)arcgis.*(portal|home)") 
| search "*<script>*" OR "*onerror=*" OR "*onload=*" OR "*javascript:alert*" OR "*document.cookie*"
| stats count by src_ip, dest_ip, uri_path, method, user
| where count > 3
| table _time, src_ip, dest_ip, uri_path, method, user, count
| sort - count

Wazuh OSSEC Rule

<group name="policy,web,attacks,">
  <rule id="297046" level="10">
    <decoded>json</decoded>
    <match>arcgis|portal</match>
    <regex>script|javascript:|onerror=|onload=|document.cookie</regex>
    <description>CVE-2026-69235: Potential stored XSS payload targeting Portal for ArcGIS</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>web_attack,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED) — No vendor advisory, patch release, or hotfix has been identified from any tracked source. Esri has acknowledged the issue indirectly by encouraging users to upgrade to the latest long-term support release, but no specific fix is available.

1) Immediate mitigations (before a patch exists):

• Restrict portal access: Limit access to Portal for ArcGIS to trusted network segments (VPN or internal-only). Use the ArcGIS Web Adaptor to enforce IP allowlisting, and disable Internet-facing exposure if not operationally required.
• Enforce privilege separation: Review portal roles and disable content-creation privileges for non-administrative users. Tightly control which users can publish items (maps, layers, apps) — the likely stored content surface.
• Web Application Firewall (WAF): Deploy a WAF in front of the portal to filter XSS payloads. Configure rules to block <script>, onerror=, javascript:, and other common payload indicators in POST bodies and URL parameters.
• Browser-side defense: Instruct portal users to disable JavaScript for the portal domain in their browsers when feasible (not practical for an interactive GIS, but applicable for read-only users). More realistically, ensure browsers are patched and use modern XSS auditor protections.

2) Patch/upgrade steps:

• Monitor Esri's official support page (https://support.esri.com) for an advisory referencing CVE-2026-69235 or a new Portal for ArcGIS release. Esri's statement "all users are advised to upgrade to the latest long-term support release" implies that upgrade path will contain the fix.
• When a patch is released, deploy in order: stage environment → test compatibility with your custom portal items and federated ArcGIS Server → schedule maintenance window → apply to production.
• If any version after 11.5 is released that includes the fix, upgrade immediately; as of writing, no such version exists.

3) Long-term hardening:

• Harden the portal: Follow Esri's "Portal for ArcGIS Security Hardening Guide" (when released) — restrict administrative access to named accounts, use SAML or OAuth for two-factor authentication, and enable network security best practices.
• Content review process: Implement a manual review process for portal items created by non-trusted users. Use Esri's content moderation features if available in the version in question.
• Monitor for post-patch regression: After a patch becomes available and is applied, audit portal logs for residual XSS attempts to identify unpatched instances or misconfigurations.
• Inventory and reduce attack surface: Disable unused portal features, remove orphaned web adaptors, and rotate portal administrative credentials regularly.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-69235 — Official vulnerability record (CVSS vector, CWE-79, description).
2. Esri Support (when available): https://support.esri.com/en/Products — Monitor for security bulletins referencing CVE-2026-69235 or Portal for ArcGIS 11.5.x patch releases.
3. CWE-79 (Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html — Classification reference for stored XSS.
4. MITRE ATT&CK — T1059.007 (JavaScript): https://attack.mitre.org/techniques/T1059/007/ — Tactic mapping for script execution.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — As of writing, CVE-2026-69235 is NOT listed (no known exploitation in the wild has been reported).

Threat actor intelligence: No threat actor campaigns, ransomware group activity, or exploit-in-the-wild evidence has been publicly linked to CVE-2026-69235. The absence of a CISA KEV listing and the lack of public PoC suggest this remains a vulnerability under active remediation rather than active exploitation.

Report generated by vartersit.com Threat Intelligence Division — 2026-02-01. This report is based solely on the NVD description and associated metadata provided. All technical claims regarding specific functions, endpoints, or payloads are omitted where not explicitly stated in source data.