PT-2026-33362 · Esri · Portal For Arcgis

Published 2026-04-16 · Updated 2026-05-18 · CVE-2026-33519

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions 11.4 through 12.0

Description An incorrect authorization issue exists where the system fails to correctly check permissions assigned to developer credentials. This flaw allows low-privilege users to generate Portal Administrator tokens by exploiting a failure in the validation of permission scopes. These unauthorized tokens can persist even after the software is patched or the user password is changed.

Recommendations Update Esri Portal for ArcGIS to a version later than 12.0. Run the Esri Credential Check Tool to identify and purge unauthorized tokens. Enforce a global policy to remove malicious credentials that may have been generated prior to patching.

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2026-33519

Affected Products

Portal For Arcgis

References · 9

• https://esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33519 · Security Note
• https://twitter.com/infoflowcloud/status/2048482523022336237 · Twitter Post
• https://t.me/cveNotify/163884 · Telegram Post
• https://twitter.com/integ_sec/status/2049140358089523248 · Twitter Post
• https://twitter.com/OrizonCyber/status/2046763436613202002 · Twitter Post
• https://hexnode.com/blogs/cve-2026-33519-arcgis-zero-trust-risk · Reddit Post
• https://twitter.com/CVEnew/status/2048481115657089231 · Twitter Post
• https://twitter.com/0dayPublishing/status/2047007501845971250 · Twitter Post