A reflected cross‑site scripting flaw exists in Esri Portal for ArcGIS allowing a remote, unauthenticated attacker to craft a malicious link. When a user clicks the link, arbitrary JavaScript can run in the victim’s browser, potentially stealing session information, defacing content, or executing further malicious actions. The vulnerability does not grant code access on the server but permits client‑side exploitation under the victim’s user context.

The flaw affects Esri Portal for ArcGIS versions 11.5 and all earlier releases. Specifically, ArcGIS Enterprise 11.1, 11.3, and 11.5 users must patch. Organizations that run the ArcGIS Web App Builder developer edition should discontinue use or migrate to ArcGIS Experience Builder, as the developer edition is unsupported for this CVE.

With a CVSS score of 6.1 the risk is moderate. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploitation at the time of this assessment. The attack vector is remote and requires an unauthenticated user to click a crafted URL, so success relies on social engineering or phishing. Once triggered, the incident can lead to data theft or session hijacking in the victim’s browser, but does not compromise the ArcGIS server itself.