Critical Privilege Escalation in Esri Portal for ArcGIS

The National Vulnerability Database has disclosed CVE-2026-33518, a critical incorrect privilege assignment vulnerability in Esri Portal for ArcGIS versions 11.5 on both Windows and Linux. This flaw, rated with a CVSS score of 9.8, allows highly privileged users to generate developer credentials with elevated permissions beyond what’s expected or intended.

This isn’t a zero-day for initial access, but it’s a critical horizontal movement and privilege escalation vector. Once an attacker gains a foothold as a highly privileged user—perhaps through social engineering, a misconfiguration, or another vulnerability—they can leverage this to create even more powerful credentials. This effectively bypasses granular access controls, granting them broader reach and deeper control within the ArcGIS environment.

The attacker’s calculus here is clear: consolidate control. Instead of being limited by their initial access, they can craft credentials that grant them administrative-level power over the GIS data and infrastructure. For defenders, this means a compromised highly privileged user becomes a far greater threat, capable of extensive data manipulation, exfiltration, or system disruption.