Skip to content
OpenAdvisories
Medium WID-SEC-2026-2966 13 CVEs

ESRI Portal für ArcGIS: Mehrere Schwachstellen

Published Aug 23, 2026 · Updated Aug 23, 2026 · de-DE

Vendor: Esri Product: ArcGIS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in ESRI Portal für ArcGIS ausnutzen, um Cross-Site-Scripting- und HTML-Injection-Angriffe durchzuführen, die Authentifizierung zu umgehen oder vertrauliche Informationen offenzulegen.

Product

ArcGIS ist ein Geoinformationssystem.

Vulnerabilities 13

  • Medium 6.1
    CVE-2026-69234

    reflected cross site scripting vulnerability in Esri Portal for ArcGIS

    There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the…

    Esri Portal for ArcGIS
  • Medium 6.1
    CVE-2026-69235

    stored cross site scripting issue in Esri Portal for ArcGIS

    There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Ente…

    Esri Portal for ArcGIS
  • Medium 6.1
    CVE-2026-69236

    stored cross site scripting issue in Esri Portal for ArcGIS

    There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with …

    Esri Portal for ArcGIS
  • Medium 5.9
    CVE-2026-69224

    information disclosure vulnerability in Esri Portal for ArcGIS

    There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier that may under difficult to reproduce circumstances allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.

    Esri Portal for ArcGIS
  • Medium 5.9
    CVE-2026-69225

    information disclosure vulnerability in Esri Portal for ArcGIS

    There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.

    Esri Portal for ArcGIS
  • Medium 5.5
    CVE-2026-69230

    stored cross site scripting issue in Esri Portal for ArcGIS

    There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working…

    Esri Portal for ArcGIS
  • Medium 5.5
    CVE-2026-69231

    stored cross site scripting issue in Esri Portal for ArcGIS

    There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with …

    Esri Portal for ArcGIS
  • Medium 5.5
    CVE-2026-69232

    stored cross site scripting issue in Esri Portal for ArcGIS

    There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with …

    Esri Portal for ArcGIS
  • Medium 5.5
    CVE-2026-69233

    stored cross site scripting issue in Esri Portal for ArcGIS

    There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working…

    Esri Portal for ArcGIS
  • Medium 5.4
    CVE-2026-69229

    HTML injection vulnerability in Esri Portal for ArcGIS

    There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5…

    Esri Portal for ArcGIS
  • Medium 5.3
    CVE-2026-69228

    missing authentication vulnerability in Esri Portal for ArcGIS

    There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) that should only be accessible by authenticated users. Users w…

    Esri Portal for ArcGIS
  • Low 3.8
    CVE-2026-69237

    HTML injection vulnerability in Esri Portal for ArcGIS

    There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 ar…

    Esri Portal for ArcGIS
  • Low 3.5
    CVE-2026-69238

    HTML injection vulnerability in Esri Portal for ArcGIS

    There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, …

    Esri Portal for ArcGIS

Revision history

  1. #1

    Initiale Fassung

References