Is CVE-2026-33518 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33518 being exploited in the wild.

How severe is CVE-2026-33518?

Critical severity, with a CVSS score of 9.8, published 21 April 2026.

Is there a fix for CVE-2026-33518?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-33518 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-33518?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33518: Esri Portal for ArcGIS incorrect privilege assignment

CVE-2026-33518 · Severity: critical · CVSS 9.8 · Published 2026-04-21

A security vulnerability in Esri Portal for ArcGIS, a platform used for managing and sharing geographic data, could allow certain users to gain more system permissions than intended. By creating specific developer credentials, an attacker could potentially escalate their privileges to perform unauthorized actions or access sensitive data. This could lead to a compromise of the mapping platform's integrity and the confidentiality of the geographic information it hosts.

Quick answers

Is CVE-2026-33518 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33518 being exploited in the wild.
How severe is CVE-2026-33518?: Critical severity, with a CVSS score of 9.8, published 21 April 2026.
Which products and versions are affected?: Esri Portal for ArcGIS 11.5.
Is there a fix for CVE-2026-33518?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-33518 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33518?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect privilege assignment vulnerability (CWE-266) exists in Esri Portal for ArcGIS version 11.5 on both Windows and Linux platforms. The flaw resides in the credential generation process, where highly privileged users can create developer credentials that inherit or grant more privileges than are appropriate or expected. While the vendor (Esri) indicates a CVSS 9.8 (unauthenticated), the NVD analysis suggests high privileges (PR:H) may be required to trigger the creation of these credentials. If exploited, this allows for significant privilege escalation within the portal environment. Users are advised to consult the Esri April 2026 Security Bulletin for patching information.

Affected products

Esri Portal for ArcGIS 11.5

Timeline

2026-04-21: disclosed
2026-04-21: advisory

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.