CVE-2026-33519CWE-266

Incorrect privilege assignment in Portal for ArcGIS

Critical · published April 21, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00483 · 40.6th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2026-04-21T20:38Z
EPSS history
Timeline
  • 21 APR 20:38Z
    Incorrect privilege assignment in Portal for ArcGIS
    cvelistv5