CVE-2026-33519

CVE-2026-33519 is an incorrect authorization vulnerability affecting Esri Portal for ArcGIS versions 11.4, 11.5, and 12.0 across Windows, Linux, and Kubernetes environments. The flaw stems from improper permission validation for developer credentials, potentially allowing unauthorized access to sensitive functions. The vulnerability carries a CVSS score of 9.8 (Critical), indicating severe risk. It is remotely exploitable over the network without requiring user interaction or authentication, and successful exploitation could result in complete compromise of confidentiality, integrity, and availability of affected systems. There is currently no evidence of active exploitation, as the vulnerability is not listed on the KEV catalog and remains inactive on security hotlists. The extremely low EPSS score of 0.0004 suggests minimal real-world exploitation probability at this time, though organizations should prioritize patching given the critical severity rating.