CVE-2026-33519

Portal for ArcGIS improperly verifies permissions assigned to developer credentials, which means that access control is not enforced according to the intended permission model. A remote, unauthenticated attacker can exploit the misconfigured authorization mechanism to gain access to resources or operations for which they should not have permissions. The vulnerability affects installations on Windows, Linux, and Kubernetes platforms.

An attacker can obtain unauthorized access to sensitive data, modify portal resources, or disrupt its availability, which corresponds to a complete breach of system confidentiality, integrity, and availability (CVSS C:H/I:H/A:H).

Patches available from the manufacturer should be applied according to references — detailed information about fixes is contained in the Esri security bulletin from April 2026 available at: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin

Esri Portal for ArcGIS in versions 11.4, 11.5, and 12.0 on Windows, Linux, and Kubernetes systems.