Is CVE-2026-33519 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33519 being exploited in the wild.

How severe is CVE-2026-33519?

Critical severity, with a CVSS score of 9.8, published 21 April 2026.

Which products and versions are affected?

Esri Portal For Arcgis 11.4, 11.5, 12.0.

Is there a fix for CVE-2026-33519?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-33519 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-33519?

Check whether you run Esri Portal For Arcgis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33519: Esri Portal for ArcGIS incorrect authorization in developer credentials

CVE-2026-33519 · Severity: critical · CVSS 9.8 · Published 2026-04-21

Esri Portal for ArcGIS, a central platform for managing and sharing geographic information, contains a critical security flaw in how it handles developer credentials. An attacker could exploit this to gain unauthorized access to the system, potentially leading to the theft of sensitive data, modification of geographic records, or disruption of mapping services. This vulnerability affects installations on Windows, Linux, and Kubernetes environments.

Technologies: Esri Portal For Arcgis. Vendors: Esri.

Quick answers

Is CVE-2026-33519 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33519 being exploited in the wild.
How severe is CVE-2026-33519?: Critical severity, with a CVSS score of 9.8, published 21 April 2026.
Which products and versions are affected?: Esri Portal For Arcgis 11.4, 11.5, 12.0.
Is there a fix for CVE-2026-33519?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-33519 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33519?: Check whether you run Esri Portal For Arcgis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability (CWE-266) exists in Esri Portal for ArcGIS versions 11.4, 11.5, and 12.0. The software fails to correctly validate permissions assigned to developer credentials, allowing an attacker to bypass intended access controls. This is a network-reachable vulnerability that requires no authentication or user interaction. Successful exploitation could grant an attacker full control over the portal's data and administrative functions (Confidentiality, Integrity, and Availability impact). The issue affects deployments across Windows, Linux, and Kubernetes platforms.

Affected products

Esri Portal for ArcGIS 11.4, 11.5, 12.0

Timeline

2026-04-21: disclosed
2026-04-21: advisory

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.