CVE-2026-33518 Details
Description
An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create developer credentials that may grant more privileges than expected.
A vulnerability in Esri Portal for ArcGIS versions 11.5 on Windows and Linux allows highly privileged users to create developer credentials that may grant excessive privileges. This incorrect privilege assignment could lead to unauthorized access or actions beyond what is intended.
Users of Esri Portal for ArcGIS 11.5 should apply the security patch released on April 13, 2026, which resets over-scoped developer credentials to their default permissions. This patch is available for both Windows and Linux. For Kubernetes customers, ArcGIS Enterprise 12.0 Update 3 should be applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| esri portal for arcgis | 11.5 - |
CPE
Remediation
| |
| linux linux kernel | All versions |
CPE
Remediation
| |
| microsoft windows | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| Apr 21, 2026 | New CVE Received | [email protected] |