CVE-2026-33519

An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:esri:portal_for_arcgis:11.4:-::::::
	cpe:2.3:a:esri:portal_for_arcgis:11.5:-::::::
	cpe:2.3:a:esri:portal_for_arcgis:12.0:-::::::

OR	cpe:2.3:a:kubernetes:kubernetes:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de autorización incorrecta existe en Esri Portal for ArcGIS 11.4, 11.5 y 12.0 en Windows, Linux y Kubernetes que no verificaba correctamente los permisos asignados a las credenciales de desarrollador.

Information

Published : 2026-04-21 21:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-33519

Mitre link : CVE-2026-33519

CVE.ORG link : CVE-2026-33519

JSON object : View

Products Affected

linux

linux_kernel

microsoft

windows

esri

portal_for_arcgis

kubernetes

kubernetes

CWE

CWE-266

Incorrect Privilege Assignment

{"id": "CVE-2026-33519", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33519", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-22T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@esri.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@esri.com", "affectedData": [{"vendor": "Esri", "product": "Portal for ArcGIS", "versions": [{"status": "affected", "version": "11.4"}, {"status": "affected", "version": "11.5"}, {"status": "affected", "version": "12.0"}], "platforms": ["Windows", "Linux", "Kubernetes"], "defaultStatus": "unaffected"}]}], "published": "2026-04-21T21:16:29.673", "references": [{"url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin", "tags": ["Vendor Advisory"], "source": "psirt@esri.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@esri.com", "description": [{"lang": "en", "value": "CWE-266"}]}], "descriptions": [{"lang": "en", "value": "An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials."}, {"lang": "es", "value": "Una vulnerabilidad de autorizaci\u00f3n incorrecta existe en Esri Portal for ArcGIS 11.4, 11.5 y 12.0 en Windows, Linux y Kubernetes que no verificaba correctamente los permisos asignados a las credenciales de desarrollador."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "532CBBBF-BB12-483C-A996-A7DE7F0330A9"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.5:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "595870AC-22E7-48D3-9C49-3917F9FC36F4"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:12.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "233E1A80-7F7D-44B3-A4A2-FA351741118A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kubernetes:kubernetes:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "14C32308-314D-4E0D-B15F-6A68DF21E9F9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@esri.com"}