CVE-2026-33519
Published: 21 April 2026
Summary
CVE-2026-33519 is a critical-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Esri Portal For Arcgis. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-33519 is an incorrect authorization vulnerability (CWE-266) in Esri Portal for ArcGIS versions 11.4, 11.5, and 12.0 on Windows, Linux, and Kubernetes platforms. The issue stems from the software failing to correctly check permissions assigned to developer credentials, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation enables high-impact compromise of confidentiality, integrity, and availability, allowing attackers to bypass authorization checks and perform actions with developer-level permissions.
Esri has published details on mitigations in its April 2026 Security Bulletin, available at https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin. Security practitioners should consult this advisory for patch information and remediation steps.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24339
Vulnerability details
An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of incorrect authorization in a public-facing ArcGIS Portal application (CWE-266) to bypass checks and obtain developer-level permissions matches T1190 exactly; no other techniques are directly enabled by the described flaw.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE's core issue by requiring enforcement of approved authorizations, preventing unauthenticated attackers from bypassing permission checks on developer credentials.
Ensures timely identification, reporting, and correction of the specific authorization flaw in Esri Portal for ArcGIS, mitigating exploitation through patching as advised in Esri's security bulletin.
Limits potential damage from the authorization bypass by restricting developer credentials to the least privileges necessary for their functions.