Quick answers
- Is CVE-2026-69238 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-69238 being exploited in the wild.
- How severe is CVE-2026-69238?
- Low severity, with a CVSS score of 3.5, published 21 August 2026.
- Which products and versions are affected?
- Esri Portal For Arcgis 11.5 and prior.
- Is there a fix for CVE-2026-69238?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-69238 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-69238?
- Check whether you run Esri Portal For Arcgis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an HTML injection flaw in the Portal for ArcGIS Home application that allows insertion of arbitrary HTML content. It affects versions 11.5 and prior, including ArcGIS Enterprise 11.1, 11.3, and 11.5. The attack requires a remote, highly privileged user account, limiting exposure to authenticated threat actors with significant system permissions. An attacker could inject malicious HTML to alter the application interface, redirect users, or steal credentials. Users are advised to upgrade to the latest long-term support release.
Affected products
- Esri Portal for ArcGIS 11.5 and prior
Timeline
- 2026-08-21: disclosed