CVE-2026-33519
Published: 21 April 2026
Summary
CVE-2026-33519 is a critical-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Esri Portal (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE's core issue by requiring enforcement of approved authorizations, preventing unauthenticated attackers from bypassing permission checks on developer credentials.
Ensures timely identification, reporting, and correction of the specific authorization flaw in Esri Portal for ArcGIS, mitigating exploitation through patching as advised in Esri's security bulletin.
Limits potential damage from the authorization bypass by restricting developer credentials to the least privileges necessary for their functions.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of incorrect authorization in a public-facing ArcGIS Portal application (CWE-266) to bypass checks and obtain developer-level permissions matches T1190 exactly; no other techniques are directly enabled by the described flaw.
NVD Description
An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.
Deeper analysisAI
CVE-2026-33519 is an incorrect authorization vulnerability (CWE-266) in Esri Portal for ArcGIS versions 11.4, 11.5, and 12.0 on Windows, Linux, and Kubernetes platforms. The issue stems from the software failing to correctly check permissions assigned to developer credentials, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation enables high-impact compromise of confidentiality, integrity, and availability, allowing attackers to bypass authorization checks and perform actions with developer-level permissions.
Esri has published details on mitigations in its April 2026 Security Bulletin, available at https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin. Security practitioners should consult this advisory for patch information and remediation steps.
Details
- CWE(s)