CVE-2026-33519 — Incorrect privilege assignment in Portal for ArcGIS

CVE-2026-33519

Incorrect privilege assignment in Portal for ArcGIS PUBLISHED

Description (CNA)

An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.

Affected (CNA)

Vendor / product	Versions
Esri / Portal for ArcGIS	affected 11.4; affected 11.5; affected 12.0

CWE

CWE-266

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.