Paper/Archive/CVE-2026-33518

CVE-2026-33518

Esri Portal for ArcGIS — Incorrect privilege assignment in Portal for ArcGIS

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 22.2.222 × 204.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create developer credentials that may grant more privileges than expected.

Affected

ProductAffectedFixed inSource

Portal for ArcGIS11.5–CNA

Scores by source

Esri (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refesri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin