CVE-2026-33519

An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-26)

CWE

CWE-266

Published

2026-04-21

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• esri:portal_for_arcgis

References

• https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin

Check your stackJSON