CVE-2026-69238

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 11.6

Description A remote, highly privileged attacker can insert arbitrary HTML into the Portal for ArcGIS Home application. HTML injection is a process where an attacker injects malicious HTML code into a webpage, which is then rendered by the browser of other users.

Recommendations Update to the latest long-term support release. Patch ArcGIS Enterprise versions 11.1, 11.3, and 11.5.