CVE-2026-33519

critical · 9.8

An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.

9.8

CVSS

0.3%

EPSS (exploit prob.)

24th

EPSS percentile

2026-04-21

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-266

Affected products

Vendor	Product	Affected versions
esri	portal_for_arcgis	11.4
esri	portal_for_arcgis	11.5
esri	portal_for_arcgis	12.0
kubernetes	kubernetes	all versions
linux	linux_kernel	all versions
microsoft	windows	all versions

Check a specific version with /api/v1/cve/match.

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-33519