CVE-2026-33518

critical · 9.8

An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create developer credentials that may grant more privileges than expected.

9.8

CVSS

0.3%

EPSS (exploit prob.)

22nd

EPSS percentile

2026-04-21

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-266

Affected products

Vendor	Product	Affected versions
esri	portal_for_arcgis	11.5
linux	linux_kernel	all versions
microsoft	windows	all versions

Check a specific version with /api/v1/cve/match.

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-33518