Description

There is a Cross‑Site Scripting (XSS) issue in Esri ArcGIS Pro versions 3.6.0 and earlier. ArcGIS Pro is a desktop application, and exploitation is limited to local users interacting with the application; no privileged role or elevated permissions are required beyond standard local user access. A local attacker can supply malicious strings that may be rendered and executed when a specific dialog within ArcGIS Pro is opened. This issue is fixed in ArcGIS Pro version 3.6.1.

INFO

Published Date :

2026-01-26T17:24:12.411Z

Last Modified :

2026-02-06T06:04:15.645Z

Source :

Esri
AFFECTED PRODUCTS

The following products are affected by CVE-2026-1446 vulnerability.

Vendors Products
Esri
  • Arcgis Pro
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-1446.

URL Resource
https://www.esri.com/arcgis-blog/products/arcgis-pro/administration/arcgis-pro-3-6-1-patch cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact