CVE-2026-33519

An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:esri:portal_for_arcgis:11.4:-::::::
	cpe:2.3:a:esri:portal_for_arcgis:11.5:-::::::
	cpe:2.3:a:esri:portal_for_arcgis:12.0:-::::::

OR	cpe:2.3:a:kubernetes:kubernetes:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

No history.

Information

Published : 2026-04-21 21:16

Updated : 2026-06-17 10:37

NVD link : CVE-2026-33519

Mitre link : CVE-2026-33519

CVE.ORG link : CVE-2026-33519

JSON object : View

Products Affected

microsoft

windows

kubernetes

kubernetes

esri

portal_for_arcgis

linux

linux_kernel

CWE

CWE-266

Incorrect Privilege Assignment

{"id": "CVE-2026-33519", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33519", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-22T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@esri.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@esri.com", "affectedData": [{"vendor": "Esri", "product": "Portal for ArcGIS", "versions": [{"status": "affected", "version": "11.4"}, {"status": "affected", "version": "11.5"}, {"status": "affected", "version": "12.0"}], "platforms": ["Windows", "Linux", "Kubernetes"], "defaultStatus": "unaffected"}]}], "published": "2026-04-21T21:16:29.673", "references": [{"url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin", "tags": ["Vendor Advisory"], "source": "psirt@esri.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@esri.com", "description": [{"lang": "en", "value": "CWE-266"}]}], "descriptions": [{"lang": "en", "value": "An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials."}], "lastModified": "2026-06-17T10:37:38.707", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "532CBBBF-BB12-483C-A996-A7DE7F0330A9"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.5:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "595870AC-22E7-48D3-9C49-3917F9FC36F4"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:12.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "233E1A80-7F7D-44B3-A4A2-FA351741118A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kubernetes:kubernetes:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "14C32308-314D-4E0D-B15F-6A68DF21E9F9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@esri.com"}