CVE-2026-33518: 
Portal for ArcGIS vulnerability analysis and mitigation

CVE-2026-33518 is an incorrect privilege assignment vulnerability (CWE-266) in Esri Portal for ArcGIS 11.5 on both Windows and Linux platforms. It allows highly privileged users to create developer credentials that may grant more privileges than intended, potentially enabling privilege escalation beyond expected boundaries. The vulnerability was published on April 21, 2026, with NVD initial analysis completed on May 18, 2026. CVSS v3.1 scores differ by source: NVD assigns 7.2 (High) reflecting the high-privilege prerequisite, while the CNA (Esri) and GitHub Advisory Database assign 9.8 (Critical) based on a no-authentication-required vector (GitHub Advisory, Esri Advisory).

The root cause is classified as CWE-266 (Incorrect Privilege Assignment), where the Portal for ArcGIS developer credential creation mechanism fails to properly constrain the privilege level of generated credentials. A highly privileged user (e.g., a portal administrator) can craft developer credentials that inherit or exceed privileges beyond what the credential type should permit. The attack vector is network-based with low complexity and requires no user interaction, though the NVD assessment notes high privileges are required as a precondition. No public proof-of-concept or detailed technical write-up describing the specific API endpoint or payload has been published (GitHub Advisory, Esri Advisory).

Successful exploitation results in high impact to confidentiality, integrity, and availability of the affected Portal for ArcGIS instance. An attacker who already holds highly privileged access could generate developer credentials with unintended elevated permissions, potentially enabling unauthorized access to sensitive geospatial data, modification of portal configurations, or disruption of portal services. The scope of impact is contained to the affected component, but the ability to create over-privileged credentials could facilitate lateral movement within connected ArcGIS enterprise environments (Esri Advisory, GitHub Advisory).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation as of the latest available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.041–0.057%, placing it in a low exploitation probability percentile. Detection support exists via Tenable Nessus plugin ID 309967 (Feedly, GitHub Advisory).

Esri has released a patch addressing this vulnerability, detailed in the April 2026 Security Bulletin. Organizations running Esri Portal for ArcGIS 11.5 on Windows or Linux should apply the available patch immediately. As interim measures, restrict network access to Portal instances using network segmentation, audit existing developer credentials for unexpected privilege levels, and monitor portal logs for unauthorized credential creation activity (Esri Advisory, GitHub Advisory).

Security news outlet SecurityOnline.info covered the vulnerability in the context of ArcGIS critical developer credential patches. BeyondMachines.net noted Esri's release of critical security patches for ArcGIS developer credential vulnerabilities. Community discussion was observed on Infosec.Exchange (Mastodon), and the vulnerability was tracked across multiple CVE aggregation platforms including VulDB and CVEFeed.io (SecurityOnline, BeyondMachines).