CVE-2026-1446mediumCWE-79

CVE-2026-1446: falha de média gravidade em Esri ArcGIS Pro

XSS issue is Esri ArcGIS Pro versions 3.6.0 and earlier

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ArcGIS Pro

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5epss 0.2%
There is a Cross‑Site Scripting (XSS) issue in Esri ArcGIS Pro versions 3.6.0 and earlier. ArcGIS Pro is a desktop application, and exploitation is limited to local users interacting with the application; no privileged role or elevated permissions are required beyond standard local user access. A local attacker can supply malicious strings that may be rendered and executed when a specific dialog within ArcGIS Pro is opened. This issue is fixed in ArcGIS Pro version 3.6.1.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Esri · ArcGIS Pro
CVEs relacionadas — Esri ArcGIS Pro

No mesmo produto, das mais perigosas para as menos.

CVE-2021-29097HIGHArcGIS general raster security update: buffer overflowEPSS 3.0%CVE-2021-29098HIGHArcGIS general raster security update: uninitialized pointerEPSS 2.0%CVE-2025-1067HIGHThere is a code injection vulnerability in ArcGIS ProEPSS 0.2%