Portal for ArcGIS 2026 Security Update 3: Fixes 13 CVEs including XSS, Info Disclosure, and Missing Auth

Vulnerability Overview Portal for ArcGIS 2026 Security Update 3 has been released to address multiple medium and low severity security vulnerabilities. This patch applies to Portal for ArcGIS versions 12.1 and earlier. The patch is cumulative; prior patches do not need to be installed separately. It is strongly recommended that all ArcGIS Enterprise customers install this patch as soon as possible. Utilizing a Web Application Firewall (WAF) and implementing the baseline profiles from the ArcGIS Hardening Guidelines can help mitigate risks. Affected Versions CVE-2026-69234: Reflected Cross-Site Scripting (XSS) vulnerability, affecting Portal for ArcGIS versions 11.5 and earlier. CVE-2026-69235: Stored Cross-Site Scripting (XSS) vulnerability, affecting Portal for ArcGIS versions 11.5 and earlier. CVE-2026-69236: Stored Cross-Site Scripting (XSS) vulnerability, affecting Portal for ArcGIS versions 12.1 and earlier. CVE-2026-69224: Information Disclosure vulnerability, affecting Portal for ArcGIS versions 12.0 and earlier. CVE-2026-69225: Information Disclosure vulnerability, affecting Portal for ArcGIS versions 11.5 and 12.0. CVE-2026-69230: Stored Cross-Site Scripting (XSS) vulnerability, affecting Portal for ArcGIS versions 11.5 and earlier. CVE-2026-69231: Stored Cross-Site Scripting (XSS) vulnerability, affecting Portal for ArcGIS versions 11.5 and earlier. CVE-2026-69232: Stored Cross-Site Scripting (XSS) vulnerability, affecting Portal for ArcGIS versions 11.5 and earlier. CVE-2026-69233: Stored Cross-Site Scripting (XSS) vulnerability, affecting Portal for ArcGIS versions 11.5 and earlier. CVE-2026-69229: HTML Injection vulnerability, affecting Portal for ArcGIS versions 12.0 and earlier. CVE-2026-69228: Authentication Bypass vulnerability, affecting Portal for ArcGIS versions 12.0 and earlier. CVE-2026-69237: HTML Injection vulnerability, affecting Portal for ArcGIS versions 11.3 and earlier. CVE-2026-69238: HTML Injection vulnerability, affecting Portal for ArcGIS versions 11.5 and earlier. Remediation Install Portal for ArcGIS 2026 Security Update 3. Utilize a Web Application Firewall (WAF) to block malicious patterns. Implement the baseline profiles from the ArcGIS Hardening Guidelines to reduce the attack surface. Proof of Concept (POC) or Exploit Code No specific POC code or exploit code is provided in the advisory.

Goal Reached Thanks to every supporter — we hit 100%!

Portal for ArcGIS 2026 Security Update 3: Fixes 13 CVEs including XSS, Info Disclosure, and Missing Auth