A remote, authenticated attacker can inject arbitrary HTML into the Esri Portal for ArcGIS Home application, leveraging a flaw in input handling (CWE‑79). This allows malicious or phishing content to be displayed to portal users, potentially compromising user trust and confidentiality. The injection occurs as part of the portal’s home page rendering, which all authenticated users can view.

The vulnerability affects Esri’s Portal for ArcGIS version 12.0 and earlier. Customers using ArcGIS Enterprise 11.1, 11.3, 11.5, and 12.0 are a high‑risk target group because the affected portal versions are included with these Enterprise releases.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is unavailable and the flaw is not listed in the CISA KEV catalog, suggesting current exploitation rates are low. The attacker must first authenticate to the portal, after which arbitrary HTML can be submitted and rendered, giving the attacker a persisting local vector that might be used for social engineering or content manipulation.