CVE-2026-69229

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 12.1

Description An HTML injection flaw allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. HTML injection is a technique where an attacker injects malicious HTML code into a webpage, which is then rendered by the browser of other users.

Recommendations Upgrade to the latest long-term support release. As a temporary mitigation, restrict authenticated access to the Portal for ArcGIS Home application to trusted users only.