Esri Portal for ArcGIS versions 12.1 and older contain a stored cross‑site scripting flaw that allows a remote, privileged attacker to inject malicious code that could execute arbitrary JavaScript in a victim’s browser. The flaw arises when user‑supplied data is stored and later rendered without proper sanitization, enabling attackers to hijack sessions, steal credentials, or perform other client‑side attacks. The impact is scoped to the victim’s browser session and can be leveraged for social‑engineering or phishing attacks.

The vulnerability affects Esri Portal for ArcGIS version 12.1 and earlier, specifically ArcGIS Enterprise releases 11.1, 11.3, 11.5, 12.0, and 12.1. Users of these versions are advised to apply Esri’s patch or upgrade to the latest long‑term support release.

The issue carries a CVSS score of 6.1, indicating medium severity, and has no EPSS score available. While not listed in the CISA KEV catalog, the vulnerability is exploitable remotely by a privileged actor. Successful exploitation would require that the attacker can provide or influence stored content displayed to other users, typically through privileged accounts or breached credentials. The risk remains moderate, but the potential for arbitrary client‑side code execution makes timely remediation important.