CVE-2026-1446

Description

There is a Cross‑Site Scripting (XSS) issue in Esri ArcGIS Pro versions 3.6.0 and earlier. ArcGIS Pro is a desktop application, and exploitation is limited to local users interacting with the application; no privileged role or elevated permissions are required beyond standard local user access. A local attacker can supply malicious strings that may be rendered and executed when a specific dialog within ArcGIS Pro is opened. This issue is fixed in ArcGIS Pro version 3.6.1.

PUBLISHED Reserved 2026-01-26 | Published 2026-01-26 | Updated 2026-02-06 | Assigner Esri

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

References

www.esri.com/...is-pro/administration/arcgis-pro-3-6-1-patch

cve.org (CVE-2026-1446)

nvd.nist.gov (CVE-2026-1446)

Download JSON