CVE-2026-33519

An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:esri:portal_for_arcgis:11.4:-::::::
	cpe:2.3:a:esri:portal_for_arcgis:11.5:-::::::
	cpe:2.3:a:esri:portal_for_arcgis:12.0:-::::::

OR	cpe:2.3:a:kubernetes:kubernetes:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

18 May 2026, 18:19

Type	Values Removed	Values Added
First Time		Kubernetes Kubernetes kubernetes Microsoft windows Linux Microsoft Esri portal For Arcgis Linux linux Kernel Esri
References	~~() https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin -~~	() https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin - Vendor Advisory
CPE		cpe:2.3:a:esri:portal_for_arcgis:11.4:-:::::: cpe:2.3:a:esri:portal_for_arcgis:11.5:-:::::: cpe:2.3:o:linux:linux_kernel:-:::::::* cpe:2.3:a:esri:portal_for_arcgis:12.0:-:::::: cpe:2.3:a:kubernetes:kubernetes:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::*

21 Apr 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-21 21:16

Updated : 2026-06-17 10:37

NVD link : CVE-2026-33519

Mitre link : CVE-2026-33519

CVE.ORG link : CVE-2026-33519

JSON object : View

Products Affected

kubernetes

kubernetes

esri

portal_for_arcgis

microsoft

windows

linux

linux_kernel

CWE

CWE-266

Incorrect Privilege Assignment

{"id": "CVE-2026-33519", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33519", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-22T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@esri.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@esri.com", "affectedData": [{"vendor": "Esri", "product": "Portal for ArcGIS", "versions": [{"status": "affected", "version": "11.4"}, {"status": "affected", "version": "11.5"}, {"status": "affected", "version": "12.0"}], "platforms": ["Windows", "Linux", "Kubernetes"], "defaultStatus": "unaffected"}]}], "published": "2026-04-21T21:16:29.673", "references": [{"url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin", "tags": ["Vendor Advisory"], "source": "psirt@esri.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@esri.com", "description": [{"lang": "en", "value": "CWE-266"}]}], "descriptions": [{"lang": "en", "value": "An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials."}], "lastModified": "2026-06-17T10:37:38.707", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "532CBBBF-BB12-483C-A996-A7DE7F0330A9"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.5:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "595870AC-22E7-48D3-9C49-3917F9FC36F4"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:12.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "233E1A80-7F7D-44B3-A4A2-FA351741118A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kubernetes:kubernetes:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "14C32308-314D-4E0D-B15F-6A68DF21E9F9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@esri.com"}