by Kastro
Paper/Archive/CVE-2026-33519

CVE-2026-33519

Esri Portal for ArcGIS — Incorrect privilege assignment in Portal for ArcGIS

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
34
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 24.1.241 × 204.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.

Affected

ProductAffectedFixed inSource
Portal for ArcGIS11.4–CNA
Portal for ArcGIS11.5–CNA
Portal for ArcGIS12.0–CNA

Scores by source

Esri (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refesri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin