CVE-2026-33518 — Incorrect privilege assignment in Portal for ArcGIS

CVE-2026-33518

Incorrect privilege assignment in Portal for ArcGIS PUBLISHED

Description (CNA)

An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create developer credentials that may grant more privileges than expected.

Affected (CNA)

Vendor / product	Versions
Esri / Portal for ArcGIS	affected 11.5

CWE

CWE-266

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.