Esri Portal for ArcGIS versions 11.5 and earlier contain an HTML injection flaw that lets a remotely authenticated attacker with high privileges place arbitrary HTML into the Home application. The injected markup can execute client‑side code, potentially enabling cross‑site scripting, phishing, or defacement of the portal. The vulnerability does not provide direct code execution on the server side, but it can compromise the integrity of the portal interface if an attacker gains privileged access.

All Esri Portal for ArcGIS installations built with ArcGIS Enterprise 11.1, 11.3, or 11.5 are affected. The flaw is limited to these older releases; any newer long‑term support release is not vulnerable.

The CVSS score of 3.5 indicates low overall severity, primarily due to the requirement that the attacker possess privileged access to insert HTML. The EPSS score is not available, suggesting insufficient data to gauge exploitation likelihood, and the issue is not listed in CISA’s KEV catalog. The attack vector is remote but depends on elevated permissions, which reduces the likelihood of widespread exploitation but could still impact organizations where administrators are not secured properly.