CVE-2026-33518

An incorrect privilege assignment vulnerability (CVE-2026-33518) has been identified in Esri Portal for ArcGIS version 11.5 running on both Windows and Linux systems. The flaw enables highly privileged users to create developer credentials that grant elevated permissions beyond their intended scope. This vulnerability carries a critical CVSS score of 9.8 with a network-based attack vector requiring no user interaction or authentication, indicating high exploitability. While the vulnerability has not been added to the Known Exploited Vulnerabilities catalog and shows minimal exploitation activity in the wild with an EPSS score of 0.00041, organizations should still prioritize patching given the critical severity rating and potential for unauthorized access to sensitive resources. The FAUCET risk assessment of 54.0 out of 100 suggests moderate overall concern, though the low current exploitation rate may allow time for coordinated remediation efforts.