A flaw allows a remote attacker who has administrative privileges to embed arbitrary HTML into an administrative API within Esri Portal for ArcGIS. The injected content can be executed in the browsers of administrators who access the affected API, leading to cross‑site scripting (XSS) that may enable credential theft, session hijack, or defacement. The weakness is a classic input validation defect classified as CWE‑79. The impact is limited to users who view the affected API outputs; it does not grant direct system compromise or persistent access beyond the injected code.

Esri Portal for ArcGIS version 11.3 and all earlier releases are affected. Clients running ArcGIS Enterprise 11.1 and 11.3 should deploy the latest patch or upgrade to the current long‑term support release to eliminate the vulnerability.

The CVSS score of 3.8 indicates low severity, reflecting the requirement that the attacker must already possess administrative privileges to exploit the issue. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread or known exploitation to date. The primary attack vector is an authenticated administrative session; an attacker could send a crafted request to the vulnerable API endpoint and inject malicious HTML that will render for any administrator viewing the API response.