Incorrect Privilege Assignment in Esri Portal for ArcGIS

Publication date: 2026-04-21

Last updated on: 2026-05-18

Assigner: Environmental Systems Research Institute, Inc.

Description

An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create developer credentials that may grant more privileges than expected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-21

Last Modified

2026-05-18

Generated

2026-07-06

AI Q&A

2026-04-22

EPSS Evaluated

2026-07-05

NVD

CVE-2026-33518

Affected Vendors & Products

Vendor	Product	Version / Range
esri	portal_for_arcgis	11.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an incorrect privilege assignment issue found in Esri Portal for ArcGIS 11.5 on both Windows and Linux platforms. It allows highly privileged users to create developer credentials that may have more privileges than intended or expected.

Impact Analysis

Because the vulnerability allows the creation of developer credentials with excessive privileges, it can lead to unauthorized access or actions within the system. This could result in a compromise of confidentiality, integrity, and availability of the affected system.

Hi! I’m here to help you understand CVE-2026-33518. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70