CVE-2026-69237

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 11.3

Description An HTML injection issue exists that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. HTML injection is a technique where an attacker injects malicious HTML code into a web page, which is then rendered by the browser of other users.

Recommendations Update to the latest long-term support release. As a temporary mitigation, restrict access to the administrative API to only trusted administrators.