Medium WID-SEC-2026-0220 1 CVE

ESRI ArcGIS: Schwachstelle ermöglicht Cross-Site Scripting

Published Jan 26, 2026 · Updated Jan 26, 2026 · de-DE

Vendor: Esri Product: ArcGIS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in ESRI ArcGIS ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

ArcGIS ist ein Geoinformationssystem.

Vulnerabilities 1

Medium 5.0

CVE-2026-1446

XSS issue is Esri ArcGIS Pro versions 3.6.0 and earlier

There is a Cross‑Site Scripting (XSS) issue in Esri ArcGIS Pro versions 3.6.0 and earlier. ArcGIS Pro is a desktop application, and exploitation is limited to local users interacting with the application; no privileged role or elevated permissions are require…

Esri ArcGIS Pro

Jan 26, 2026

Revision history

2026-01-26 #1
Initiale Fassung

References

ArcGIS Blog vom 2026-01-26
https://www.esri.com/arcgis-blog/products/arcgis-pro/administration/arcgis-pro-3-6-1-patch
NIST CVE-2026-1446
https://nvd.nist.gov/vuln/detail/CVE-2026-1446