CVE-2026-1446

CVSS Score & Metrics

Base Score

5.0 / 10

Vector String

                                        CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N                                    

Vulnerability Description

There is a Cross Site Scripting issue in Esri ArcGIS Pro versions 3.6.0 and earlier. A local attacker could supply malicious strings into ArcGIS Pro which may execute when a specific dialog is opened. This issue is fixed in ArcGIS Pro 3.6.1.

Vulnerability Details

Published Date

January 26, 2026

Last Modified

February 02, 2026

CWE ID

CWE-79

Source

NVD

Vendor

esri

Product

arcgis_pro

External References

https://www.esri.com/arcgis-blog/products/arcgis-pro/administration/arcgis-pro-3-6-1-patch

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment