# CVE-2026-50096: Esri Portal for ArcGIS reflected cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-50096-there-is-a-reflected-cross-site-scripting-vulnerability-in-esri  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-50096 · Severity: medium · CVSS 6.1 · Published 2026-10-26

Esri Portal for ArcGIS is a web-based platform for managing and sharing geographic information systems data. An unauthenticated attacker can craft a malicious link that, when clicked by a victim, executes arbitrary JavaScript code in the user's browser, potentially compromising their credentials or session data. This vulnerability affects Portal for ArcGIS versions 12.1 and earlier.

Technologies: [Esri Portal For Arcgis](https://junglewise.ai/threats/technologies/portal-for-arcgis). Vendors: [Esri](https://junglewise.ai/threats/vendors/esri).

## Quick answers

**Is CVE-2026-50096 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50096 being exploited in the wild.

**How severe is CVE-2026-50096?** Medium severity, with a CVSS score of 6.1, published 26 October 2026.

**Which products and versions are affected?** Esri Portal For Arcgis 12.1 and prior.

**Is there a fix for CVE-2026-50096?** Yes: fixed in Portal for ArcGIS 12.1, 12.0, 11.5, 11.3, 11.1 (patched versions available; earlier versions in mature or retired status are not patch eligible). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50096 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-50096?** Check whether you run Esri Portal For Arcgis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Portal for ArcGIS 12.1, 12.0, 11.5, 11.3, 11.1 (patched versions available; earlier versions in mature or retired status are not patch eligible)

## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in Portal for ArcGIS versions 12.1 and prior, allowing unauthenticated remote attackers to inject malicious JavaScript via a crafted URL. The vulnerability requires user interaction (clicking a link) to execute. Exploitation results in arbitrary script execution in the victim's browser context, potentially enabling account takeover or session hijacking. Patches are available for versions 12.1, 12.0, 11.5, 11.3, and 11.1.

## Affected products

- Esri Portal for ArcGIS 12.1 and prior

## Timeline

- 2026-10-26: disclosed

## References

- [https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/october-2026-arcgis-security-bulletin](https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/october-2026-arcgis-security-bulletin)

## Related threats

- [Esri Portal for ArcGIS reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-33520-there-is-a-reflected-cross-site-scripting-vulnerability-in-esri)
- [Esri Portal for ArcGIS authentication bypass in admin API](https://junglewise.ai/threats/cve-2026-69227-a-flaw-in-portal-for-arcgis-allows-unauthenticated-access-to)
- [Esri Portal for ArcGIS account creation bypass in sharing endpoint](https://junglewise.ai/threats/cve-2026-69226-a-flaw-in-portal-for-arcgis-allows-unauthenticated-users-to)
- [Esri Portal for ArcGIS LDAP injection in administrative functionality](https://junglewise.ai/threats/cve-2026-10759-a-flaw-in-portal-for-arcgis-could-allow-ldap-injection-through)
- [Esri Portal for ArcGIS HTML injection](https://junglewise.ai/threats/cve-2026-69238-esri-portal-for-arcgis-html-injection)