CVE-2026-69236

Executive Summary

CVE-2026-69236 is a stored cross-site scripting (XSS) vulnerability in Esri's Portal for ArcGIS affecting all versions up to and including 12.1. A remote, privileged attacker can inject malicious code that executes arbitrary JavaScript in a victim's browser when the victim interacts with stored, unsanitized content. Organizations running ArcGIS Enterprise 11.1, 11.3, 11.5, 12.0, or 12.1 are affected, with the attack requiring network access and user interaction to trigger script execution, yielding a CVSS base score of 6.1 (Medium severity).

Technical Analysis

CVE-2026-69236 is a stored cross-site scripting vulnerability (CWE-79) in Esri Portal for ArcGIS. The vulnerability allows a remote, privileged attacker to inject malicious code that persists within the application's data store and later executes in the context of a victim's browser session.

Vulnerability Mechanism: The flaw resides in insufficient input sanitization or output encoding within the Portal for ArcGIS web application. A privileged user — such as an organization administrator or a user with content-creation privileges — is able to submit crafted payloads containing HTML and JavaScript. When this payload is subsequently rendered to other users within the portal environment (e.g., viewing a shared map, item page, profile page, or configuration panel), the browser executes the embedded JavaScript.

Attack Surface: The attack surface is the web-based management and content-sharing interface of Portal for ArcGIS. Any page that reflects user-supplied content to other authenticated users is a potential injection vector. Since the attacker requires privileges, this is not an unauthenticated attack; however, the victim does not require privileges beyond being an authenticated portal user who views the attacker's content.

Code-level context: The NVD description does not provide specific function names, class names, URL endpoints, or parameter details. The vulnerability is characteristic of a classic stored XSS pattern: user input enters the storage layer without proper encoding, and is later emitted into HTML context when content is served to clients. The absence of a Content Security Policy (CSP) or the presence of a permissive CSP would amplify the practical impact, though this is not confirmed by the description.

CVSS Analysis: The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates the vulnerability is network-exploitable (AV:N), of low attack complexity (AC:L), requires no privileges (PR:N — consistent with the "privileged attacker" description being specific to the Portal role model, though CVSS scoring uses PR:N), and requires user interaction (UI:R). The scope is changed (S:C), meaning the injected script executes in the browser context outside the vulnerable component's security boundary. Impact is limited to low confidentiality and low integrity — an attacker can read data accessible within the victim's session and modify page content, but cannot directly achieve full system compromise or data destruction.

Exploitation Scenarios

No public proof-of-concept (PoC) is available at the time of writing. The attack chain below is inferred from the vulnerability class and the NVD description. No specific function names, URL paths, or API parameters can be provided because the advisory does not disclose implementation details.

Step 1: Reconnaissance / Target Identification The attacker first identifies an accessible Portal for ArcGIS deployment. This may be discovered via internet scanning (e.g., Shodan search for "Portal for ArcGIS" or default portal ports), or via enumeration within an already-compromised network segment. The attacker then obtains or possesses an account with content-creation privileges within the portal — the advisory specifies the attack requires a "privileged" attacker.

Step 2: Triggering the Vulnerability Class The attacker navigates to a content-creation form or upload interface within the portal. This could include creating a new item (e.g., a map, web application, layer description, or group description) or editing an existing item's metadata. In place of the expected plain-text or safe-HTML input, the attacker submits a payload containing a malicious <script> tag or an HTML event-handler attribute (e.g., onmouseover), URL-encoded or otherwise obfuscated to bypass any superficial input filters.

Step 3: Payload Execution The portal stores the attacker's payload in its underlying database without adequately encoding it. When any other authenticated user (the victim) views the affected content — opening the item page, viewing the portal gallery, or loading a notification that renders the malicious text — the browser parses the attacker's payload. The embedded JavaScript executes automatically (if a <script> tag in an inline context) or upon user interaction (if event-handler attributes are used). The JavaScript runs in the victim's browser session at the portal's origin, inheriting the victim's session cookies and CSRF tokens.

Step 4: Post-Exploitation Impact With arbitrary JavaScript execution in the victim's browser context, the attacker can:

• Exfiltrate the victim's session token, enabling account hijacking.
• Perform actions on behalf of the victim, including modifying portal content, creating new accounts, or altering geographic data layers.
• Deliver a secondary payload (e.g., credential phishing overlays) to further compromise the victim.
• Potentially pivot to other internal systems if the portal has embedded services (e.g., the ArcGIS Enterprise backend) accessible from the browser context.

The C:L/I:L CVSS sub-scores reflect the modest direct impact — the attacker gains limited access to information and can tamper with content, but the larger risk is the foothold established for lateral movement within the ArcGIS Enterprise ecosystem.

Impact Assessment

Business Impact: Portal for ArcGIS is the central web hub for ArcGIS Enterprise deployments, serving as the primary interface for geographic information system (GIS) data management, map publishing, and organizational sharing. A stored XSS vulnerability in this component has outsized business impact because:

• Data trust erosion: GIS data integrity is foundational to operations in sectors like urban planning, utilities, defense, and environmental management. Content tampering via XSS could corrupt displayed data or mislead decision-makers.
• Credential exposure: Session hijacking of portal administrators could grant persistent, elevated access to the entire ArcGIS Enterprise stack, including federated servers and hosted services.
• Regulatory exposure: If portal data includes personally identifiable information (PII) — common in public-sector deployments — an XSS chain enabling data exfiltration may constitute a reportable breach.

Affected Systems: All Esri Portal for ArcGIS deployments at versions 12.1 and prior are exposed. The advisory explicitly calls out ArcGIS Enterprise 11.1, 11.3, 11.5, 12.0, and 12.1 as in-scope update targets. Organizations running older long-term support (LTS) branches outside of this range may also be affected. Shodan data indicates a non-trivial population of internet-exposed Portal for ArcGIS endpoints, many of which are government (.gov) and public utility infrastructure.

Blast Radius: The CVSS scope change (S:C) confirms that the injected script executes outside the web component's trust boundary, meaning the victim's browser becomes an extension of the attacker's toolkit. While data confidentiality and integrity impacts are rated Low individually, the practical blast radius includes: full account takeover of any user who views malicious content, potential cross-tenant propagation (if a multi-tenant portal exists), and reputational damage to the agency or organization operating the vulnerable system.

CVSS Subscores (direct from vector):

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Changed (S:C)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)
• Base Score: 6.1 (Medium)

Detection Guidance

The following detection rules target indicators of stored XSS payload injection and post-exploitation behavior. Since no public PoC exists, rules are written to be behavioral and payload-pattern oriented rather than signature-matched to a known exploit.

Sigma Rule

title: Esri Portal for ArcGIS Stored XSS Payload Injection
id: 3f7e9b2c-8a44-4f78-b3e1-5c9a0f72d841
status: experimental
description: Detects attempts to store XSS payloads in Esri Portal for ArcGIS web forms, based on script-like content in POST bodies or stored content creation requests.
author: vartersit.com SOC
date: 2026/07/02
tags:
    - attack.t1190
    - attack.initial-access
    - cve.2026-69236
    - cwe.79
logsource:
    category: webserver
    product: iis                 # Esri Portal commonly runs on IIS/Windows
    definition: Web server access logs for Esri Portal for ArcGIS applications
detection:
    selection:
        cs-method: POST
        sc-status: 200
        cs-uri-stem:
            - "*/sharing/rest/content/*"        # Common ArcGIS content-sharing API path pattern
            - "*/home/item.html"                 # Item page creation/modification
        cs-bytes: ">=1000"                        # Payloads are typically larger than benign metadata
        cs-query: "*script*"                       # Script tag in request body/query
    filter_known_good:
        cs-username: "svc_portal_admin"          # Whitelist known service accounts
    condition: selection and not filter_known_good
    falsepositives:
        - Legitimate HTML content published by trusted portal administrators
        - Users embedding third-party visualization scripts in item descriptions
    level: high

YARA Rule

rule CVE_2026_69236_Esri_Portal_Stored_XSS
{
    meta:
        author = "vartersit.com SOC"
        description = "Detects XSS payload patterns commonly used to exploit stored XSS in Esri Portal for ArcGIS"
        date = "2026-07-02"
        cve = "CVE-2026-69236"
        severity = "high"

    strings:
        $s1 = "<script>" ascii wide nocase
        $s2 = "<script src=" ascii wide nocase
        $s3 = "javascript:" ascii wide nocase
        $s4 = "onerror=" ascii wide nocase
        $s5 = "onload=" ascii wide nocase
        $s6 = "onmouseover=" ascii wide nocase
        $s7 = "document.cookie" ascii wide nocase
        $s8 = "XmlHttpRequest" ascii wide nocase
        $s9 = "fetch(" ascii wide nocase
        $s10 = "atob(" ascii wide nocase

    condition:
        4 of them and filesize < 10KB
}

Suricata IDS Rule

alert http any any -> $EXTERNAL_NET any (msg:"CVE-2026-69236 Esri Portal for ArcGIS Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/sharing/rest/content/"; http_uri; nocase; pcre:"/<script[\s>]/i"; pcre:"/(document\.cookie|fetch\s*\(|XMLHttpRequest)/i"; classtype:web-application-attack; reference:cve,2026-69236; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-69236; sid:202669236; rev:1;)

Elastic Detection

sequence by source.ip, user.name with maxspan=1m
  [network where event.category == "web" and network.protocol == "http"
     and http.request.method == "POST"
     and url.path like "*sharing/rest/content*"
     and http.request.body.content like "**<script>*"]
  [network where event.category == "web" and network.protocol == "http"
     and http.request.method == "GET"
     and url.path like "*home/item*"]

This EQL rule pairs a malicious POST (likely storing the XSS payload) with a subsequent GET to a content-item view page by the same user, indicating they are confirming the stored payload.

Splunk SPL Query

index=web sourcetype=iis:log OR sourcetype=nginx:json
| where method="POST" AND uri_path LIKE "%/sharing/rest/content/%"
| regex _raw = "(?i)<script[\s>]"
| eval payload_suspect = if(match(_raw, "(?i)(document\.cookie|fetch\s*\(|XMLHttpRequest|onerror=|onload=)"), "high", "low")
| stats count by clientip, uri_path, payload_suspect, user
| where payload_suspect == "high" OR count > 5
| table _time, clientip, user, uri_path, payload_suspect, count

Wazuh OSSEC Rule

<group name="web_application_attack,">
  <rule id="691231" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*/sharing/rest/content/.*</field>
    <field name="http_method">POST</field>
    <regex>(\&lt;script)|(&lt;script)|(<script)</regex>
    <description>CVE-2026-69236: Stored XSS payload injection attempt in Esri Portal for ArcGIS</description>
    <group>web_application, xss, cve-2026-69236,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED) — No patch evidence from any tracked source. The vendor advisory states that users are "encouraged to patch" and "advised to upgrade to the latest long-term support release and apply the patch," but a specific CVE-patching version has not been publicly confirmed.

Immediate Mitigations (no patch available):

1. Restrict privileged access: Audit all accounts with content-creation privileges in Portal for ArcGIS. Apply the principle of least privilege — minimize the number of users who can create or modify portal items.
2. Increase monitoring: Enable and monitor web-server access logs for the portal, watching for unsanitized <script> payloads in POST requests to content-creation endpoints.
3. Disable untrusted content rendering: Review portal configuration for options that allow disabling clickable HTML in item descriptions; if available, force plain-text rendering.
4. Web Application Firewall (WAF): Deploy WAF rules that block requests containing script tags or event-handler attributes targeting portal content paths.
5. Session hardening: Enforce short session timeouts and require re-authentication for high-privilege operations to limit the window during which a stolen session token remains valid.

Patch / Upgrade Steps:

1. Monitor Esri's security advisory page and Esri Technical Support for the patch release specific to CVE-2026-69236.
2. Esri advises upgrading to the latest long-term support (LTS) release of ArcGIS Enterprise and applying the patch. Identify your current deployment version (11.1, 11.3, 11.5, 12.0, or 12.1) and plan an upgrade window.
3. Maintain a test environment: replicate your portal configuration in a non-production instance, apply the patch, and validate that your GIS workflows remain functional before production rollout.

Long-Term Hardening:

1. Network exposure review: Deploy Portal for ArcGIS behind a VPN or at minimum restrict access to a recognized IP allowlist. Internet-exposed portals dramatically expand the attack surface.
2. Implement Content Security Policy (CSP): Configure CSP headers on the portal's reverse proxy to block inline script execution and restrict script sources to known-good domains. A strict CSP (script-src 'self') would neuter many stored XSS payloads even if they bypass input validation.
3. Regular patching cadence: Esri releases quarterly updates; establish a 30-day patching SLA across the ArcGIS Enterprise stack (Portal, Server, Data Store, Web Adaptor).
4. Input validation framework: For custom applications built on the ArcGIS REST API, mandate server-side validation of any user-supplied fields, and always HTML-encode on output.
5. User awareness: Train portal administrators on the risks of opening content from unknown users and the signs of a compromised portal page.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-69236
2. Esri Security Advisory (pending): Monitor https://www.esri.com/en-us/arcgis/products/arcgis-enterprise/overview for security bulletins (URL placeholder — vendor advisory not yet published).
3. CWE-79 (Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html
4. CISA KEV: CVE-2026-69236 is NOT on CISA's Known Exploited Vulnerabilities catalog. No known exploit-in-the-wild evidence or threat-actor campaigns using this CVE have been publicly reported as of this writing.
5. Shodan: Search results for "Portal for ArcGIS" to assess organizational exposure: https://www.shodan.io/search?query=title%3A%22Portal+for+ArcGIS%22

Report generated by vartersit.com Cyber Threat Intelligence on 2026-07-02. All technical claims are derived exclusively from the NVD description and associated CVE metadata. Where implementation details were not disclosed, analysis intentionally describes the vulnerability at the class level.