What is the CVSS score of CVE-2026-33518?

CVE-2026-33518 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Portal For Arcgis are affected by CVE-2026-33518?

Esri Portal for ArcGIS 11.5 (Windows and Linux) contains a privilege escalation vulnerability allowing highly privileged users to mint API credentials that exceed their authorization scope, bypassing…

How to fix or mitigate CVE-2026-33518?

Within 24 hours, identify all users with administrative or credential-creation permissions in Portal for ArcGIS 11.5 and audit all API credentials (OAuth applications and API keys) created in the past 30 days for privilege escalation indicators. Within 7 days, rotate all API credentials issued by administrative users, enforce 90-day maximum lifetime on all new credentials, enable detailed logging of all API calls, and configure daily alerts for anomalous API activity. Within 30 days, monitor Esri's security portal for a patch release; upon availability, deploy to all Portal for ArcGIS 11.5 instances within 14 days; if no patch is released within 60 days, plan an upgrade to Portal for ArcGIS 12.0 or later.

Portal For Arcgis CVE-2026-33518

EUVD-2026-24337 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-04-21 Esri

Information Disclosure Microsoft Portal For Arcgis Esri

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:40 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24337

CVE Published

Apr 21, 2026 - 20:37 nvd

CRITICAL 9.8

DescriptionCVE.org

An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create developer credentials that may grant more privileges than expected.

AnalysisAI

Privilege escalation in Esri Portal for ArcGIS 11.5 on Windows and Linux allows highly privileged users to mint developer credentials (API keys/OAuth application credentials) that carry more privileges than the issuing account should be able to delegate, breaking the platform's privilege boundary. No public exploit is identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total and automatable. Note a significant signal conflict: the published CVSS 9.8 vector uses PR:N (unauthenticated) while the vendor description explicitly requires a 'highly privileged' user, which materially lowers the realistic risk.