Zetlyn
GitHubGet started

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, authenticated attac…

cve CVE-2025-57876 1 source, 1 claim · Watch

NVD writes:
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal. the claim
Severity
MEDIUM NVD
CVSS
4.8 NVD
Vendor
Esri NVD
Product
Portal for ArcGIS NVD
CWE
CWE-79 NVD

How far exploitation has got

  1. No public code known
  2. Proof of concept
  3. Proof of concept, verified
  4. A Metasploit module
  5. Exploited in the wild
  6. Used in ransomware campaigns

Timeline

2025-09-29first spoke of it: There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.NVD

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.

What it is to other things

affectsesri/portal_for_arcgis
NVD
made_byesri
NVD
Every value, with what each source said and its receipt
PropertySourceSaidMeans here
Automatable
automatable
NVDno
At least one of those steps needs a person.
receipt
Source
NVD
Its words
no
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since
2026-10-06 11:54 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 11:54 UTCno
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Windows",
              "Linux"
            ],
            "product": "Portal for ArcGIS",
            "vendor": "Esri",
            "versions": [
              {
                "lessThanOrEqual": "11.4",
                "status": "affected",
                "version": "10.9.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@esri.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "43F37C65-CBEC-4688-8DB4-B58C83EEBC92",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "A97FDB6F-0614-4F4A-91F1-09C230ED5E3C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "7770A56F-0801-4982-828E-F43446224608",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.0:*:*:*:*:*:*:*",
                "matchCriteriaId": "2A62FCB5-12A6-487C-BCA9-0AD3F11354CD",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "57DA68A3-0E09-4C8C-A98E-B027964FA17A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "C3A6B038-6C92-4A34-B980-E3872265FF89",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "4DA6D70E-60D6-4CE6-AFA4-7BB191A23E3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "9FCD40AD-6D5B-498C-AFD7-B84B4FD1E3F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "3E2AE6CA-0F8E-4D40-94E3-FEAB2E7E2CF7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:-:*:*:*:*:*:*",
                "matchCriteriaId": "3460737E-3181-4FCB-9A2B-D4C27C5FC774",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "E56FFF86-E366-4910-8ECB-9F93F903762F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "F299D739-C8EA-4BEC-A356-3ED7F49A9A3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "8B46D70A-E101-407D-B326-034232260364",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "021904ED-87FD-4FB4-BCC8-DE89DB05FB66",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*",
                "matchCriteriaId": "CF8719BA-95F6-4AB6-8A86-6742BE828260",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "7C19F9C7-F687-4865-8535-2E99E0AB0157",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "FC7EED3B-056E-4B86-94E4-FF0B62E376CA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:-:*:*:*:*:*:*",
                "matchCriteriaId": "532CBBBF-BB12-483C-A996-A7DE7F0330A9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "967840A2-98F6-4729-B979-32628AA34F38",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "278C5760-3183-4A79-BE1F-A280BD5A3274",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "There is a stored Cross-site Scripting vulnerability in  Esri Portal for ArcGIS  11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal."
      },
      {
        "lang": "es",
        "value": "Hay una vulnerabilidad de cross-site scripting almacenada en Esri Portal for ArcGIS 11.4 y versiones anteriores que puede permitir a un atacante remoto y autenticado inyectar un archivo malicioso con un script XSS incrustado que, al cargarse, podría ejecutar potencialmente código JavaScript arbitrario en el navegador de la víctima. Los privilegios requeridos para ejecutar este ataque son altos. El ataque podría divulgar un token privilegiado, lo que podría resultar en que el atacante obtenga el control total del Portal."
      }
    ],
    "id": "CVE-2025-57876",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 2.7,
          "source": "psirt@esri.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57876",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-29T19:52:09.396974Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-29T19:15:36.720",
    "references": [
      {
        "source": "psirt@esri.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch"
      }
    ],
    "sourceIdentifier": "psirt@esri.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@esri.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CVSS
cvss
NVD4.8
receipt
Source
NVD
Its words
4.8
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Windows",
              "Linux"
            ],
            "product": "Portal for ArcGIS",
            "vendor": "Esri",
            "versions": [
              {
                "lessThanOrEqual": "11.4",
                "status": "affected",
                "version": "10.9.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@esri.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "43F37C65-CBEC-4688-8DB4-B58C83EEBC92",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "A97FDB6F-0614-4F4A-91F1-09C230ED5E3C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "7770A56F-0801-4982-828E-F43446224608",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.0:*:*:*:*:*:*:*",
                "matchCriteriaId": "2A62FCB5-12A6-487C-BCA9-0AD3F11354CD",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "57DA68A3-0E09-4C8C-A98E-B027964FA17A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "C3A6B038-6C92-4A34-B980-E3872265FF89",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "4DA6D70E-60D6-4CE6-AFA4-7BB191A23E3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "9FCD40AD-6D5B-498C-AFD7-B84B4FD1E3F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "3E2AE6CA-0F8E-4D40-94E3-FEAB2E7E2CF7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:-:*:*:*:*:*:*",
                "matchCriteriaId": "3460737E-3181-4FCB-9A2B-D4C27C5FC774",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "E56FFF86-E366-4910-8ECB-9F93F903762F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "F299D739-C8EA-4BEC-A356-3ED7F49A9A3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "8B46D70A-E101-407D-B326-034232260364",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "021904ED-87FD-4FB4-BCC8-DE89DB05FB66",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*",
                "matchCriteriaId": "CF8719BA-95F6-4AB6-8A86-6742BE828260",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "7C19F9C7-F687-4865-8535-2E99E0AB0157",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "FC7EED3B-056E-4B86-94E4-FF0B62E376CA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:-:*:*:*:*:*:*",
                "matchCriteriaId": "532CBBBF-BB12-483C-A996-A7DE7F0330A9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "967840A2-98F6-4729-B979-32628AA34F38",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "278C5760-3183-4A79-BE1F-A280BD5A3274",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "There is a stored Cross-site Scripting vulnerability in  Esri Portal for ArcGIS  11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal."
      },
      {
        "lang": "es",
        "value": "Hay una vulnerabilidad de cross-site scripting almacenada en Esri Portal for ArcGIS 11.4 y versiones anteriores que puede permitir a un atacante remoto y autenticado inyectar un archivo malicioso con un script XSS incrustado que, al cargarse, podría ejecutar potencialmente código JavaScript arbitrario en el navegador de la víctima. Los privilegios requeridos para ejecutar este ataque son altos. El ataque podría divulgar un token privilegiado, lo que podría resultar en que el atacante obtenga el control total del Portal."
      }
    ],
    "id": "CVE-2025-57876",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 2.7,
          "source": "psirt@esri.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57876",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-29T19:52:09.396974Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-29T19:15:36.720",
    "references": [
      {
        "source": "psirt@esri.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch"
      }
    ],
    "sourceIdentifier": "psirt@esri.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@esri.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CVSS vector
cvss_vector
NVDCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
receipt
Source
NVD
Its words
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since
2026-10-06 11:54 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 11:54 UTCCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Windows",
              "Linux"
            ],
            "product": "Portal for ArcGIS",
            "vendor": "Esri",
            "versions": [
              {
                "lessThanOrEqual": "11.4",
                "status": "affected",
                "version": "10.9.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@esri.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "43F37C65-CBEC-4688-8DB4-B58C83EEBC92",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "A97FDB6F-0614-4F4A-91F1-09C230ED5E3C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "7770A56F-0801-4982-828E-F43446224608",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.0:*:*:*:*:*:*:*",
                "matchCriteriaId": "2A62FCB5-12A6-487C-BCA9-0AD3F11354CD",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "57DA68A3-0E09-4C8C-A98E-B027964FA17A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "C3A6B038-6C92-4A34-B980-E3872265FF89",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "4DA6D70E-60D6-4CE6-AFA4-7BB191A23E3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "9FCD40AD-6D5B-498C-AFD7-B84B4FD1E3F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "3E2AE6CA-0F8E-4D40-94E3-FEAB2E7E2CF7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:-:*:*:*:*:*:*",
                "matchCriteriaId": "3460737E-3181-4FCB-9A2B-D4C27C5FC774",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "E56FFF86-E366-4910-8ECB-9F93F903762F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "F299D739-C8EA-4BEC-A356-3ED7F49A9A3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "8B46D70A-E101-407D-B326-034232260364",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "021904ED-87FD-4FB4-BCC8-DE89DB05FB66",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*",
                "matchCriteriaId": "CF8719BA-95F6-4AB6-8A86-6742BE828260",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "7C19F9C7-F687-4865-8535-2E99E0AB0157",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "FC7EED3B-056E-4B86-94E4-FF0B62E376CA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:-:*:*:*:*:*:*",
                "matchCriteriaId": "532CBBBF-BB12-483C-A996-A7DE7F0330A9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "967840A2-98F6-4729-B979-32628AA34F38",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "278C5760-3183-4A79-BE1F-A280BD5A3274",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "There is a stored Cross-site Scripting vulnerability in  Esri Portal for ArcGIS  11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal."
      },
      {
        "lang": "es",
        "value": "Hay una vulnerabilidad de cross-site scripting almacenada en Esri Portal for ArcGIS 11.4 y versiones anteriores que puede permitir a un atacante remoto y autenticado inyectar un archivo malicioso con un script XSS incrustado que, al cargarse, podría ejecutar potencialmente código JavaScript arbitrario en el navegador de la víctima. Los privilegios requeridos para ejecutar este ataque son altos. El ataque podría divulgar un token privilegiado, lo que podría resultar en que el atacante obtenga el control total del Portal."
      }
    ],
    "id": "CVE-2025-57876",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 2.7,
          "source": "psirt@esri.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57876",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-29T19:52:09.396974Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-29T19:15:36.720",
    "references": [
      {
        "source": "psirt@esri.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch"
      }
    ],
    "sourceIdentifier": "psirt@esri.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@esri.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CWE
cwe
NVDCWE-79
receipt
Source
NVD
Its words
CWE-79
Read by
field:cve.weaknesses[].description[].value
Said since
2026-10-06 11:54 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 11:54 UTCCWE-79
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Windows",
              "Linux"
            ],
            "product": "Portal for ArcGIS",
            "vendor": "Esri",
            "versions": [
              {
                "lessThanOrEqual": "11.4",
                "status": "affected",
                "version": "10.9.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@esri.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "43F37C65-CBEC-4688-8DB4-B58C83EEBC92",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "A97FDB6F-0614-4F4A-91F1-09C230ED5E3C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "7770A56F-0801-4982-828E-F43446224608",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.0:*:*:*:*:*:*:*",
                "matchCriteriaId": "2A62FCB5-12A6-487C-BCA9-0AD3F11354CD",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "57DA68A3-0E09-4C8C-A98E-B027964FA17A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "C3A6B038-6C92-4A34-B980-E3872265FF89",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "4DA6D70E-60D6-4CE6-AFA4-7BB191A23E3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "9FCD40AD-6D5B-498C-AFD7-B84B4FD1E3F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "3E2AE6CA-0F8E-4D40-94E3-FEAB2E7E2CF7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:-:*:*:*:*:*:*",
                "matchCriteriaId": "3460737E-3181-4FCB-9A2B-D4C27C5FC774",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "E56FFF86-E366-4910-8ECB-9F93F903762F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "F299D739-C8EA-4BEC-A356-3ED7F49A9A3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "8B46D70A-E101-407D-B326-034232260364",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "021904ED-87FD-4FB4-BCC8-DE89DB05FB66",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*",
                "matchCriteriaId": "CF8719BA-95F6-4AB6-8A86-6742BE828260",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "7C19F9C7-F687-4865-8535-2E99E0AB0157",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "FC7EED3B-056E-4B86-94E4-FF0B62E376CA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:-:*:*:*:*:*:*",
                "matchCriteriaId": "532CBBBF-BB12-483C-A996-A7DE7F0330A9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "967840A2-98F6-4729-B979-32628AA34F38",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "278C5760-3183-4A79-BE1F-A280BD5A3274",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "There is a stored Cross-site Scripting vulnerability in  Esri Portal for ArcGIS  11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal."
      },
      {
        "lang": "es",
        "value": "Hay una vulnerabilidad de cross-site scripting almacenada en Esri Portal for ArcGIS 11.4 y versiones anteriores que puede permitir a un atacante remoto y autenticado inyectar un archivo malicioso con un script XSS incrustado que, al cargarse, podría ejecutar potencialmente código JavaScript arbitrario en el navegador de la víctima. Los privilegios requeridos para ejecutar este ataque son altos. El ataque podría divulgar un token privilegiado, lo que podría resultar en que el atacante obtenga el control total del Portal."
      }
    ],
    "id": "CVE-2025-57876",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 2.7,
          "source": "psirt@esri.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57876",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-29T19:52:09.396974Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-29T19:15:36.720",
    "references": [
      {
        "source": "psirt@esri.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch"
      }
    ],
    "sourceIdentifier": "psirt@esri.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@esri.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Exploitation
exploitation
NVDnone
No evidence of exploitation, and no public proof of concept.
receipt
Source
NVD
Its words
none
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since
2026-10-06 11:54 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 11:54 UTCnone
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Windows",
              "Linux"
            ],
            "product": "Portal for ArcGIS",
            "vendor": "Esri",
            "versions": [
              {
                "lessThanOrEqual": "11.4",
                "status": "affected",
                "version": "10.9.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@esri.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "43F37C65-CBEC-4688-8DB4-B58C83EEBC92",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "A97FDB6F-0614-4F4A-91F1-09C230ED5E3C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "7770A56F-0801-4982-828E-F43446224608",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.0:*:*:*:*:*:*:*",
                "matchCriteriaId": "2A62FCB5-12A6-487C-BCA9-0AD3F11354CD",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "57DA68A3-0E09-4C8C-A98E-B027964FA17A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "C3A6B038-6C92-4A34-B980-E3872265FF89",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "4DA6D70E-60D6-4CE6-AFA4-7BB191A23E3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "9FCD40AD-6D5B-498C-AFD7-B84B4FD1E3F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "3E2AE6CA-0F8E-4D40-94E3-FEAB2E7E2CF7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:-:*:*:*:*:*:*",
                "matchCriteriaId": "3460737E-3181-4FCB-9A2B-D4C27C5FC774",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "E56FFF86-E366-4910-8ECB-9F93F903762F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "F299D739-C8EA-4BEC-A356-3ED7F49A9A3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "8B46D70A-E101-407D-B326-034232260364",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "021904ED-87FD-4FB4-BCC8-DE89DB05FB66",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*",
                "matchCriteriaId": "CF8719BA-95F6-4AB6-8A86-6742BE828260",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "7C19F9C7-F687-4865-8535-2E99E0AB0157",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "FC7EED3B-056E-4B86-94E4-FF0B62E376CA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:-:*:*:*:*:*:*",
                "matchCriteriaId": "532CBBBF-BB12-483C-A996-A7DE7F0330A9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "967840A2-98F6-4729-B979-32628AA34F38",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "278C5760-3183-4A79-BE1F-A280BD5A3274",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "There is a stored Cross-site Scripting vulnerability in  Esri Portal for ArcGIS  11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal."
      },
      {
        "lang": "es",
        "value": "Hay una vulnerabilidad de cross-site scripting almacenada en Esri Portal for ArcGIS 11.4 y versiones anteriores que puede permitir a un atacante remoto y autenticado inyectar un archivo malicioso con un script XSS incrustado que, al cargarse, podría ejecutar potencialmente código JavaScript arbitrario en el navegador de la víctima. Los privilegios requeridos para ejecutar este ataque son altos. El ataque podría divulgar un token privilegiado, lo que podría resultar en que el atacante obtenga el control total del Portal."
      }
    ],
    "id": "CVE-2025-57876",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 2.7,
          "source": "psirt@esri.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57876",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-29T19:52:09.396974Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-29T19:15:36.720",
    "references": [
      {
        "source": "psirt@esri.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch"
      }
    ],
    "sourceIdentifier": "psirt@esri.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@esri.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Product
product
NVDPortal for ArcGIS
receipt
Source
NVD
Its words
Portal for ArcGIS
Read by
field:cve.affected[].affectedData[].product
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Windows",
              "Linux"
            ],
            "product": "Portal for ArcGIS",
            "vendor": "Esri",
            "versions": [
              {
                "lessThanOrEqual": "11.4",
                "status": "affected",
                "version": "10.9.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@esri.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "43F37C65-CBEC-4688-8DB4-B58C83EEBC92",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "A97FDB6F-0614-4F4A-91F1-09C230ED5E3C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "7770A56F-0801-4982-828E-F43446224608",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.0:*:*:*:*:*:*:*",
                "matchCriteriaId": "2A62FCB5-12A6-487C-BCA9-0AD3F11354CD",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "57DA68A3-0E09-4C8C-A98E-B027964FA17A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "C3A6B038-6C92-4A34-B980-E3872265FF89",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "4DA6D70E-60D6-4CE6-AFA4-7BB191A23E3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "9FCD40AD-6D5B-498C-AFD7-B84B4FD1E3F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "3E2AE6CA-0F8E-4D40-94E3-FEAB2E7E2CF7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:-:*:*:*:*:*:*",
                "matchCriteriaId": "3460737E-3181-4FCB-9A2B-D4C27C5FC774",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "E56FFF86-E366-4910-8ECB-9F93F903762F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "F299D739-C8EA-4BEC-A356-3ED7F49A9A3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "8B46D70A-E101-407D-B326-034232260364",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "021904ED-87FD-4FB4-BCC8-DE89DB05FB66",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*",
                "matchCriteriaId": "CF8719BA-95F6-4AB6-8A86-6742BE828260",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "7C19F9C7-F687-4865-8535-2E99E0AB0157",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "FC7EED3B-056E-4B86-94E4-FF0B62E376CA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:-:*:*:*:*:*:*",
                "matchCriteriaId": "532CBBBF-BB12-483C-A996-A7DE7F0330A9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "967840A2-98F6-4729-B979-32628AA34F38",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "278C5760-3183-4A79-BE1F-A280BD5A3274",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "There is a stored Cross-site Scripting vulnerability in  Esri Portal for ArcGIS  11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal."
      },
      {
        "lang": "es",
        "value": "Hay una vulnerabilidad de cross-site scripting almacenada en Esri Portal for ArcGIS 11.4 y versiones anteriores que puede permitir a un atacante remoto y autenticado inyectar un archivo malicioso con un script XSS incrustado que, al cargarse, podría ejecutar potencialmente código JavaScript arbitrario en el navegador de la víctima. Los privilegios requeridos para ejecutar este ataque son altos. El ataque podría divulgar un token privilegiado, lo que podría resultar en que el atacante obtenga el control total del Portal."
      }
    ],
    "id": "CVE-2025-57876",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 2.7,
          "source": "psirt@esri.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57876",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-29T19:52:09.396974Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-29T19:15:36.720",
    "references": [
      {
        "source": "psirt@esri.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch"
      }
    ],
    "sourceIdentifier": "psirt@esri.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@esri.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Severity
severity
NVDMEDIUM
From 4.0 to 6.9.
receipt
Source
NVD
Its words
MEDIUM
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since
2026-10-06 11:54 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 11:54 UTCMEDIUM
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Windows",
              "Linux"
            ],
            "product": "Portal for ArcGIS",
            "vendor": "Esri",
            "versions": [
              {
                "lessThanOrEqual": "11.4",
                "status": "affected",
                "version": "10.9.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@esri.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "43F37C65-CBEC-4688-8DB4-B58C83EEBC92",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "A97FDB6F-0614-4F4A-91F1-09C230ED5E3C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "7770A56F-0801-4982-828E-F43446224608",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.0:*:*:*:*:*:*:*",
                "matchCriteriaId": "2A62FCB5-12A6-487C-BCA9-0AD3F11354CD",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "57DA68A3-0E09-4C8C-A98E-B027964FA17A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "C3A6B038-6C92-4A34-B980-E3872265FF89",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "4DA6D70E-60D6-4CE6-AFA4-7BB191A23E3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "9FCD40AD-6D5B-498C-AFD7-B84B4FD1E3F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "3E2AE6CA-0F8E-4D40-94E3-FEAB2E7E2CF7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:-:*:*:*:*:*:*",
                "matchCriteriaId": "3460737E-3181-4FCB-9A2B-D4C27C5FC774",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "E56FFF86-E366-4910-8ECB-9F93F903762F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "F299D739-C8EA-4BEC-A356-3ED7F49A9A3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "8B46D70A-E101-407D-B326-034232260364",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "021904ED-87FD-4FB4-BCC8-DE89DB05FB66",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*",
                "matchCriteriaId": "CF8719BA-95F6-4AB6-8A86-6742BE828260",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "7C19F9C7-F687-4865-8535-2E99E0AB0157",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "FC7EED3B-056E-4B86-94E4-FF0B62E376CA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:-:*:*:*:*:*:*",
                "matchCriteriaId": "532CBBBF-BB12-483C-A996-A7DE7F0330A9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "967840A2-98F6-4729-B979-32628AA34F38",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "278C5760-3183-4A79-BE1F-A280BD5A3274",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "There is a stored Cross-site Scripting vulnerability in  Esri Portal for ArcGIS  11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal."
      },
      {
        "lang": "es",
        "value": "Hay una vulnerabilidad de cross-site scripting almacenada en Esri Portal for ArcGIS 11.4 y versiones anteriores que puede permitir a un atacante remoto y autenticado inyectar un archivo malicioso con un script XSS incrustado que, al cargarse, podría ejecutar potencialmente código JavaScript arbitrario en el navegador de la víctima. Los privilegios requeridos para ejecutar este ataque son altos. El ataque podría divulgar un token privilegiado, lo que podría resultar en que el atacante obtenga el control total del Portal."
      }
    ],
    "id": "CVE-2025-57876",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 2.7,
          "source": "psirt@esri.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57876",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-29T19:52:09.396974Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-29T19:15:36.720",
    "references": [
      {
        "source": "psirt@esri.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch"
      }
    ],
    "sourceIdentifier": "psirt@esri.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@esri.com",
        "type": "Secondary"
      }
    ]
  }
}
medium
Status
status
NVDAnalyzed
receipt
Source
NVD
Its words
Analyzed
Read by
field:cve.vulnStatus
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Windows",
              "Linux"
            ],
            "product": "Portal for ArcGIS",
            "vendor": "Esri",
            "versions": [
              {
                "lessThanOrEqual": "11.4",
                "status": "affected",
                "version": "10.9.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@esri.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "43F37C65-CBEC-4688-8DB4-B58C83EEBC92",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "A97FDB6F-0614-4F4A-91F1-09C230ED5E3C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "7770A56F-0801-4982-828E-F43446224608",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.0:*:*:*:*:*:*:*",
                "matchCriteriaId": "2A62FCB5-12A6-487C-BCA9-0AD3F11354CD",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "57DA68A3-0E09-4C8C-A98E-B027964FA17A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "C3A6B038-6C92-4A34-B980-E3872265FF89",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "4DA6D70E-60D6-4CE6-AFA4-7BB191A23E3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "9FCD40AD-6D5B-498C-AFD7-B84B4FD1E3F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "3E2AE6CA-0F8E-4D40-94E3-FEAB2E7E2CF7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:-:*:*:*:*:*:*",
                "matchCriteriaId": "3460737E-3181-4FCB-9A2B-D4C27C5FC774",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "E56FFF86-E366-4910-8ECB-9F93F903762F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "F299D739-C8EA-4BEC-A356-3ED7F49A9A3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "8B46D70A-E101-407D-B326-034232260364",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "021904ED-87FD-4FB4-BCC8-DE89DB05FB66",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*",
                "matchCriteriaId": "CF8719BA-95F6-4AB6-8A86-6742BE828260",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "7C19F9C7-F687-4865-8535-2E99E0AB0157",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "FC7EED3B-056E-4B86-94E4-FF0B62E376CA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:-:*:*:*:*:*:*",
                "matchCriteriaId": "532CBBBF-BB12-483C-A996-A7DE7F0330A9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "967840A2-98F6-4729-B979-32628AA34F38",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "278C5760-3183-4A79-BE1F-A280BD5A3274",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "There is a stored Cross-site Scripting vulnerability in  Esri Portal for ArcGIS  11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal."
      },
      {
        "lang": "es",
        "value": "Hay una vulnerabilidad de cross-site scripting almacenada en Esri Portal for ArcGIS 11.4 y versiones anteriores que puede permitir a un atacante remoto y autenticado inyectar un archivo malicioso con un script XSS incrustado que, al cargarse, podría ejecutar potencialmente código JavaScript arbitrario en el navegador de la víctima. Los privilegios requeridos para ejecutar este ataque son altos. El ataque podría divulgar un token privilegiado, lo que podría resultar en que el atacante obtenga el control total del Portal."
      }
    ],
    "id": "CVE-2025-57876",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 2.7,
          "source": "psirt@esri.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57876",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-29T19:52:09.396974Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-29T19:15:36.720",
    "references": [
      {
        "source": "psirt@esri.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch"
      }
    ],
    "sourceIdentifier": "psirt@esri.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@esri.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Technical impact
technical_impact
NVDpartial
The attacker gains limited control, or limited information.
receipt
Source
NVD
Its words
partial
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since
2026-10-06 11:54 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 11:54 UTCpartial
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Windows",
              "Linux"
            ],
            "product": "Portal for ArcGIS",
            "vendor": "Esri",
            "versions": [
              {
                "lessThanOrEqual": "11.4",
                "status": "affected",
                "version": "10.9.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@esri.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "43F37C65-CBEC-4688-8DB4-B58C83EEBC92",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "A97FDB6F-0614-4F4A-91F1-09C230ED5E3C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "7770A56F-0801-4982-828E-F43446224608",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.0:*:*:*:*:*:*:*",
                "matchCriteriaId": "2A62FCB5-12A6-487C-BCA9-0AD3F11354CD",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "57DA68A3-0E09-4C8C-A98E-B027964FA17A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "C3A6B038-6C92-4A34-B980-E3872265FF89",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "4DA6D70E-60D6-4CE6-AFA4-7BB191A23E3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "9FCD40AD-6D5B-498C-AFD7-B84B4FD1E3F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "3E2AE6CA-0F8E-4D40-94E3-FEAB2E7E2CF7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:-:*:*:*:*:*:*",
                "matchCriteriaId": "3460737E-3181-4FCB-9A2B-D4C27C5FC774",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "E56FFF86-E366-4910-8ECB-9F93F903762F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "F299D739-C8EA-4BEC-A356-3ED7F49A9A3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "8B46D70A-E101-407D-B326-034232260364",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "021904ED-87FD-4FB4-BCC8-DE89DB05FB66",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*",
                "matchCriteriaId": "CF8719BA-95F6-4AB6-8A86-6742BE828260",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "7C19F9C7-F687-4865-8535-2E99E0AB0157",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "FC7EED3B-056E-4B86-94E4-FF0B62E376CA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:-:*:*:*:*:*:*",
                "matchCriteriaId": "532CBBBF-BB12-483C-A996-A7DE7F0330A9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "967840A2-98F6-4729-B979-32628AA34F38",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "278C5760-3183-4A79-BE1F-A280BD5A3274",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "There is a stored Cross-site Scripting vulnerability in  Esri Portal for ArcGIS  11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal."
      },
      {
        "lang": "es",
        "value": "Hay una vulnerabilidad de cross-site scripting almacenada en Esri Portal for ArcGIS 11.4 y versiones anteriores que puede permitir a un atacante remoto y autenticado inyectar un archivo malicioso con un script XSS incrustado que, al cargarse, podría ejecutar potencialmente código JavaScript arbitrario en el navegador de la víctima. Los privilegios requeridos para ejecutar este ataque son altos. El ataque podría divulgar un token privilegiado, lo que podría resultar en que el atacante obtenga el control total del Portal."
      }
    ],
    "id": "CVE-2025-57876",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 2.7,
          "source": "psirt@esri.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57876",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-29T19:52:09.396974Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-29T19:15:36.720",
    "references": [
      {
        "source": "psirt@esri.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch"
      }
    ],
    "sourceIdentifier": "psirt@esri.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@esri.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Vendor
vendor
NVDEsri
receipt
Source
NVD
Its words
Esri
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Windows",
              "Linux"
            ],
            "product": "Portal for ArcGIS",
            "vendor": "Esri",
            "versions": [
              {
                "lessThanOrEqual": "11.4",
                "status": "affected",
                "version": "10.9.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@esri.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "43F37C65-CBEC-4688-8DB4-B58C83EEBC92",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "A97FDB6F-0614-4F4A-91F1-09C230ED5E3C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "7770A56F-0801-4982-828E-F43446224608",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.0:*:*:*:*:*:*:*",
                "matchCriteriaId": "2A62FCB5-12A6-487C-BCA9-0AD3F11354CD",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*",
                "matchCriteriaId": "57DA68A3-0E09-4C8C-A98E-B027964FA17A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "C3A6B038-6C92-4A34-B980-E3872265FF89",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "4DA6D70E-60D6-4CE6-AFA4-7BB191A23E3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "9FCD40AD-6D5B-498C-AFD7-B84B4FD1E3F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "3E2AE6CA-0F8E-4D40-94E3-FEAB2E7E2CF7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:-:*:*:*:*:*:*",
                "matchCriteriaId": "3460737E-3181-4FCB-9A2B-D4C27C5FC774",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update1:*:*:*:*:*:*",
                "matchCriteriaId": "E56FFF86-E366-4910-8ECB-9F93F903762F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update2:*:*:*:*:*:*",
                "matchCriteriaId": "F299D739-C8EA-4BEC-A356-3ED7F49A9A3B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "8B46D70A-E101-407D-B326-034232260364",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "021904ED-87FD-4FB4-BCC8-DE89DB05FB66",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*",
                "matchCriteriaId": "CF8719BA-95F6-4AB6-8A86-6742BE828260",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "7C19F9C7-F687-4865-8535-2E99E0AB0157",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "FC7EED3B-056E-4B86-94E4-FF0B62E376CA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:-:*:*:*:*:*:*",
                "matchCriteriaId": "532CBBBF-BB12-483C-A996-A7DE7F0330A9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update1:*:*:*:*:*:*",
                "matchCriteriaId": "967840A2-98F6-4729-B979-32628AA34F38",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update2:*:*:*:*:*:*",
                "matchCriteriaId": "278C5760-3183-4A79-BE1F-A280BD5A3274",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "There is a stored Cross-site Scripting vulnerability in  Esri Portal for ArcGIS  11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal."
      },
      {
        "lang": "es",
        "value": "Hay una vulnerabilidad de cross-site scripting almacenada en Esri Portal for ArcGIS 11.4 y versiones anteriores que puede permitir a un atacante remoto y autenticado inyectar un archivo malicioso con un script XSS incrustado que, al cargarse, podría ejecutar potencialmente código JavaScript arbitrario en el navegador de la víctima. Los privilegios requeridos para ejecutar este ataque son altos. El ataque podría divulgar un token privilegiado, lo que podría resultar en que el atacante obtenga el control total del Portal."
      }
    ],
    "id": "CVE-2025-57876",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 2.7,
          "source": "psirt@esri.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57876",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-29T19:52:09.396974Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-29T19:15:36.720",
    "references": [
      {
        "source": "psirt@esri.com",
        "tags": [
          "Patch",
          "Vendor Advisory"
        ],
        "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch"
      }
    ],
    "sourceIdentifier": "psirt@esri.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@esri.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Every claim, by kind

vulnerability

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.
zetlyn/cve-nvd · 2025-09-29
automatable no cvss 4.8 cvss_vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N cwe CWE-79 exploitation none product Portal for ArcGIS severity MEDIUM status Analyzed technical_impact partial vendor Esri source