CVE-2026-33519 CRITICAL

CVE-2026-33519: Incorrect privilege assignment in Portal for ArcGIS

Vendor Esri
Product Portal for ArcGIS
Weakness CWE-266
Published April 21, 2026
Last update April 23, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.

Key dates

02Disclosure timeline

April 21, 2026 CVE published
April 23, 2026 Record updated