What is the CVSS score of CVE-2026-33519?

CVE-2026-33519 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Portal for ArcGIS are affected by CVE-2026-33519?

Esri Portal for ArcGIS (versions 11.4-12.0 across Windows, Linux, and Kubernetes) contains a critical access control flaw that allows holders of developer credentials to access resources and perform…

How to fix or mitigate CVE-2026-33519?

Within 24 hours, identify all Portal instances running versions 11.4, 11.5, or 12.0 and audit the full list of developer credentials currently provisioned. Within 7 days, revoke all developer credentials (assume potential compromise given the 9.8 vulnerability scope), restrict Portal network access via firewall to known required consumers only, and enable audit logging on all resource access and permission-related API calls. Within 30 days, monitor Esri's security advisories for patched versions and commit to an upgrade timeline; if patches remain unavailable beyond 90 days, evaluate architectural alternatives or air-gap the affected systems.

Portal for ArcGIS CVE-2026-33519

EUVD-2026-24339 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-04-21 Esri

GHSA-rvfx-c797-vvhx

Information Disclosure Kubernetes Microsoft Portal For Arcgis Esri

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Description ties the flaw to developer credentials so PR:L not PR:N; Information Disclosure tag drives C:H with limited integrity impact and no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:39 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24339

CVE Published

Apr 21, 2026 - 20:38 nvd

CRITICAL 9.8

DescriptionCVE.org

An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.

AnalysisAI

Broken access control in Esri Portal for ArcGIS 11.4, 11.5, and 12.0 (Windows, Linux, and Kubernetes) fails to correctly validate the permissions bound to developer credentials, allowing a holder of such credentials to access resources or perform actions beyond their intended authorization. The vendor rates it CVSS 9.8 (network, no privileges, no interaction), though the description's reference to 'developer credentials' implies some prior credential is involved. There is no public exploit identified at time of analysis and EPSS is very low (0.04%, 13th percentile), but SSVC flags the technical impact as total and the flaw as automatable.

Technical ContextAI

Portal for ArcGIS is the identity, sharing, and content-management tier of the ArcGIS Enterprise platform, providing a web portal and REST API layer over ArcGIS Server for hosting maps, apps, and geospatial services. The single affected CPE is cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*, and the platform ships across Windows, Linux, and Kubernetes deployments (the latter reflected in the Kubernetes tag). The root cause is CWE-266 (Incorrect Privilege Assignment): the authorization logic that maps developer credentials - API keys or OAuth application credentials used by developers to call ArcGIS APIs - to their effective permission set does not enforce those permissions correctly, so the granted privilege exceeds what was assigned. The Information Disclosure tag indicates the practical consequence is unauthorized read access to protected portal content.

RemediationAI

Patch available per vendor advisory: apply the fix described in the Esri April 2026 ArcGIS security bulletin (https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin); the input data does not include an exact patched build number, so consult that bulletin for the specific version or patch for your 11.4, 11.5, or 12.0 deployment. Until patched, reduce exposure by restricting network reachability of the Portal admin and sharing REST endpoints to trusted management networks rather than the public internet, and by auditing and rotating developer credentials (API keys and OAuth application credentials) and revoking any that are unused or over-scoped - noting that credential rotation can break dependent developer integrations and automation, so coordinate with app owners. Review portal content-sharing settings to minimize the blast radius of any unauthorized read access. These are compensating controls, not a substitute for the vendor fix.