CVE-2026-69235

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 11.6

Description A stored cross site scripting issue exists that allows a remote, privileged attacker to inject malicious code. This code could potentially execute arbitrary scripts within the browser of a victim user.

Recommendations Update to the latest long-term support release. As a temporary mitigation, restrict the privileges of users who can perform actions leading to the storage of malicious scripts.