Description
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
Published: 2026-10-26
Score: 6.1 Medium
EPSS: n/a
KEV: No
Impact: Remote Cross‑Site Scripting
Action: Immediate Patch
AI Analysis

Impact

A reflected cross‑site scripting flaw exists in Esri Portal for ArcGIS versions 12.1 and earlier, allowing an unauthenticated attacker to construct a malicious link. When a victim clicks the link, arbitrary JavaScript can execute in the victim’s browser, potentially leading to information theft, session hijacking, or malicious actions performed on behalf of the user.

Affected Systems

The vulnerability affects Esri ArcGIS Server products, specifically versions 12.1, 12.0, 11.5, 11.3, and 11.1. A patch is available for these General Availability and Extended support releases. Versions in mature or retired status are not patch eligible, and users of such versions should seek an upgrade to a supported, unpatched release.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires delivery of a crafted link and user interaction, meaning the attack vector is remote, unauthenticated, and user‑dependent. With the EPSS score unavailable, the potential for widespread exploitation remains uncertain but the impact on affected systems warrants timely action.

Generated by OpenCVE AI on October 26, 2026 at 19:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest official Esri patch for ArcGIS Server 12.1 and earlier.
  • Upgrade to a supported ArcGIS Server version beyond 12.1 that is not vulnerable.
  • If an immediate upgrade is not possible, restrict access to the portal and monitor for suspicious link activity.

Generated by OpenCVE AI on October 26, 2026 at 19:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Esri
Esri arcgis Server
Vendors & Products Esri
Esri arcgis Server

Mon, 26 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
Description There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
Title BUG-000187164 - ArcGIS Server has a security vulnerability.
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Esri Arcgis Server
cve-icon MITRE

Status: PUBLISHED

Assigner: Esri

Published:

Updated: 2026-10-26T19:38:28.569Z

Reserved: 2026-06-03T14:47:46.182Z

Link: CVE-2026-50096

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-26T18:17:48.703

Modified: 2026-10-26T18:31:27.923

Link: CVE-2026-50096

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T19:24:18Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')