The vulnerability is a stored cross‑site scripting (XSS) flaw in Esri Portal for ArcGIS. It allows a remote, privileged attacker to inject malicious code that can be stored and subsequently executed as JavaScript within a victim’s web browser. This could enable the attacker to manipulate the client side of the application, capture user session data, or redirect users to malicious sites. The weakness is classified as CWE‑79 and does not provide direct token or remote code execution but can lead to significant privilege escalation within a user’s session.

Esri Portal for ArcGIS versions 11.5 and earlier, including 11.1, 11.3, and 11.5, are affected. Administrators should verify the installed version and determine whether the system is within the vulnerable range. All users of ArcGIS Enterprise 11.1, 11.3, and 11.5 are urged to apply the published patch or upgrade to the latest long‑term support release.

The CVSS score of 5.5 indicates moderate severity; however, the vulnerability requires a privileged user account, limiting the attacker's reach. EPSS data is not available, and the issue is not currently listed in the CISA KEV catalog, suggesting that widespread exploitation is not documented. Nonetheless, because the flaw permits arbitrary JavaScript execution in the browser, organizations should adopt the vendor patch promptly to eliminate the risk of client‑side compromise.