# CVE-2026-33519: Esri Portal for ArcGIS incorrect authorization in developer credentials

Source: https://junglewise.ai/threats/cve-2026-33519-esri-portal-for-arcgis-incorrect-authorization-in-developer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-21. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-33519 · Severity: critical · CVSS 9.8 · Published 2026-04-21

Esri Portal for ArcGIS, a central platform for managing and sharing geographic information, contains a critical security flaw in how it handles developer credentials. An attacker could exploit this to gain unauthorized access to the system, potentially leading to the theft of sensitive data, modification of geographic records, or disruption of mapping services. This vulnerability affects installations on Windows, Linux, and Kubernetes environments.

Technologies: [Esri Portal For Arcgis](https://junglewise.ai/threats/technologies/portal-for-arcgis). Vendors: [Esri](https://junglewise.ai/threats/vendors/esri).

## Quick answers

**Is CVE-2026-33519 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33519 being exploited in the wild.

**How severe is CVE-2026-33519?** Critical severity, with a CVSS score of 9.8, published 21 April 2026.

**Which products and versions are affected?** Esri Portal For Arcgis 11.4, 11.5, 12.0.

**Is there a fix for CVE-2026-33519?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-33519 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-33519?** Check whether you run Esri Portal For Arcgis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability (CWE-266) exists in Esri Portal for ArcGIS versions 11.4, 11.5, and 12.0. The software fails to correctly validate permissions assigned to developer credentials, allowing an attacker to bypass intended access controls. This is a network-reachable vulnerability that requires no authentication or user interaction. Successful exploitation could grant an attacker full control over the portal's data and administrative functions (Confidentiality, Integrity, and Availability impact). The issue affects deployments across Windows, Linux, and Kubernetes platforms.

## Affected products

- Esri Portal for ArcGIS 11.4, 11.5, 12.0

## Timeline

- 2026-04-21: disclosed
- 2026-04-21: advisory

## References

- [https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin](https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin)

## Related threats

- [Esri Portal for ArcGIS reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-50096-there-is-a-reflected-cross-site-scripting-vulnerability-in-esri)
- [Esri Portal for ArcGIS reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-33520-there-is-a-reflected-cross-site-scripting-vulnerability-in-esri)
- [Esri Portal for ArcGIS authentication bypass in admin API](https://junglewise.ai/threats/cve-2026-69227-a-flaw-in-portal-for-arcgis-allows-unauthenticated-access-to)
- [Esri Portal for ArcGIS account creation bypass in sharing endpoint](https://junglewise.ai/threats/cve-2026-69226-a-flaw-in-portal-for-arcgis-allows-unauthenticated-users-to)
- [Esri Portal for ArcGIS LDAP injection in administrative functionality](https://junglewise.ai/threats/cve-2026-10759-a-flaw-in-portal-for-arcgis-could-allow-ldap-injection-through)