CVE-2026-33518 CRITICAL

CVE-2026-33518: Incorrect privilege assignment in Portal for ArcGIS

Vendor Esri

Product Portal for ArcGIS

Weakness CWE-266

Published April 21, 2026

Last update April 23, 2026

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create developer credentials that may grant more privileges than expected.

Key dates

02Disclosure timeline

April 21, 2026 CVE published

April 23, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-33518 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/266.html

Related vulnerabilities

04Related CVE

CVE-2025-55707 WordPress PostX Plugin <= 4.1.35 - Privilege Escalation Vulnerability CVE-2020-14318 CVE-2021-40124 Cisco AnyConnect Secure Mobility Client for Windows with Network Access Manager Module Privilege Escalation Vulnerability CVE-2026-23800 WordPress Modular DS plugin <= 2.5.2 - Privilege Escalation vulnerability CVE-2026-49060 WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability