Critical Esri Portal Vulnerability: Incorrect Authorization Exposes Developer Credentials

The National Vulnerability Database has disclosed CVE-2026-33519, a critical incorrect authorization vulnerability in Esri Portal for ArcGIS versions 11.4, 11.5, and 12.0. This flaw, present across Windows, Linux, and Kubernetes deployments, stems from an inadequate permissions check on developer credentials. Attackers exploiting this could bypass intended authorization controls, leading to severe consequences.

Rated with a CVSS score of 9.8 (CRITICAL), this vulnerability poses a significant risk. The root cause, classified as CWE-266 (Incorrect Privilege Assignment), indicates that the system failed to properly enforce access restrictions, allowing unauthorized actors to potentially leverage developer credentials to gain elevated access. This is not a theoretical concern; it’s a direct path to compromise.

For defenders, this means assuming a worst-case scenario. An unauthenticated attacker could exploit this remotely, without user interaction, to achieve full compromise (C:H, I:H, A:H). The attacker’s calculus here is straightforward: find an exposed Esri Portal instance, exploit the authorization flaw, and gain control. This is a high-reward target, especially given the critical data often managed within GIS environments.