CVE-2026-33519Disclosure(esri / kubernetes)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch esri kubernetes systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.

esri CVEs Back to dashboard

1.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin

Weakness type (CWE)

CWE-266

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

kubernetes
linux_kernel
portal_for_arcgis
windows

Threat summary

Patch or workaround signal is available
7 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 2 classified signals
Peaked 3d ago at 2 mentions (2026-04-22); latest day: 1
7 total mentions across 5 days

Affected systems

Vendors

esri kubernetes linux microsoft

Products

kuberneteslinux_kernelportal_for_arcgiswindows

4 versions affected across 4 products

Deep dive

Activity timeline7 mentions / 5d

Signal classification3 categories

Disclosure

342.9%

Patch

228.6%

General

228.6%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-21	1	Disclosure1
2026-04-22	2	Disclosure1Patch1
2026-04-26	2	Disclosure1General1
2026-04-28	1	Patch1
2026-05-14	1	General1

Full discourse7 posts

Orizon@OrizonCyber170d
Patch
🚨 CVE-2026-33519 — CVSS 9.8/10 ██████████ An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/9OKVHDx9bx
Post summary
A critical incorrect‑authorization flaw (CVE‑2026‑33519) affecting Esri Portal for ArcGIS 11.4–12.0 is confirmed, and a patch is immediately available.
1000059
28 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker148d
General
影響範囲と対処法をやさしく整理、まずは要点を確認しましょう。【脆弱性情報】 CVE-2026-33519 Esri Portal for ArcGISの脆弱性について https://www.cybernote.click/2026/04/25/%e3%80%90%e8%84%86%e5%bc%b1%e6%80%a7%e6%83%85%e5%a0%b1%e3%80%91-cve-2026-33519-%e4%b8%8d%e6%98%8e%e3%81%aeesri-portal-for-arcgis%e3%81%ae%e8%84%86%e5%bc%b1%e6%80%a7%e3%81%ab%e3%81%a4%e3%81%84%e3%81%a6/?utm_source=rss&utm_medium=rss&utm_campaign=%25e3%2580%2590%25e8%2584%2586%25e5%25bc%25b1%25e6%2580%25a7%25e6%2583%2585%25e5%25a0%25b1%25e3%2580%2591-cve-2026-33519-%25e4%25b8%258d%25e6%2598%258e%25e3%2581%25aeesri-portal-for-arcgis%25e3%2581%25ae%25e8%2584%2586%25e5%25bc%25b1%25e6%2580%25a7%25e3%2581%25ab%25e3%2581%25a4%25e3%2581%2584%25e3%2581%25a6 #ブログ仲間と繋がりたい #Webライター
Post summary
The post is a brief notice linking to a blog article that provides an overview of CVE‑2026‑33519 for Esri Portal for ArcGIS, with no detailed technical information, exploit code, or evidence of active exploitation.
0000048
211 followersView on X
IntegSec@integ_sec164d
Patch
CVE-2026-33519: Esri Portal for ArcGIS Authorization Flaw - What It Means for Your Business and How to Respond https://hubs.li/Q04dKpCX0
Post summary
The linked article addresses the Esri Portal for ArcGIS authorization flaw (CVE‑2026‑33519) and offers guidance on how to respond, likely including patching or other mitigations.
0000028
29 followersView on X
Infoflowcloud@infoflowcloud166d
General
🚨*CVE* CVE-2026-33519 An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permission… https://www.cve.org/CVERecord?id=CVE-2026-33519 ----- Traducción: CVE-2026-33519 Exi… http://infoflow.cloud`
Post summary
The post simply announces CVE-2026-33519 and links to the CVE record, with no additional technical or exploit information.
0000038
72 followersView on X
CVE@CVEnew166d
Disclosure
CVE-2026-33519 An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permission… https://www.cve.org/CVERecord?id=CVE-2026-33519
Post summary
The post announces that CVE‑2026‑33519 is an authorization flaw in Esri Portal for ArcGIS across multiple versions, with no evidence of exploitation or patch information.
00000234
57.3K followersView on X
0day Signal@0dayPublishing170d
Disclosure
🚨 CVE-2026-33519: Incorrect privilege assignment i... Developer creds bypass auth checks = instant admin access to enterprise GIS infrastructure hosting critical geospatial ... https://zerodaysignal.com/vulnerability/CVE-2026-33519 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
A new CVE‑2026‑33519 has been highlighted, detailing a privilege escalation flaw in GIS infrastructure that allows developer credentials to bypass authentication, with a link to a zero‑day signal report.
0000077
218 followersView on X
Kaitan ID Security@KaitanSecurity170d
Disclosure
🚨 CRITICAL — CVE-2026-33519 An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kub… CVSS 9.8 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-33519 #Linux #CyberSecurity #InfoSec
Post summary
The text announces a critical authorization flaw (CVE-2026-33519) in Esri Portal for ArcGIS 11.4–12.0 across multiple platforms, with a CVSS score of 9.8 and no patch available yet.
0000010
124 followersView on X

CPE platform detail6 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

6 of 6 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	esri	portal_for_arcgis	11.4	-	-
App	esri	portal_for_arcgis	11.5	-	-
App	esri	portal_for_arcgis	12.0	-	-
App	kubernetes	kubernetes	-	-	-
OS	linux	linux_kernel	-	-	-
OS	microsoft	windows	-	-	-

Explore more

Back to dashboard esri CVEs kubernetes CVEs linux CVEs kubernetes vulnerabilities

What researchers are saying

CVE-2026-33519

Orizon[verified]@OrizonCyberPatch

A critical incorrect‑authorization flaw (CVE‑2026‑33519) affecting Esri Portal for ArcGIS 11.4–12.0 is confirmed, and a patch is immediately available.

IntegSec[verified]@integ_secPatch

The linked article addresses the Esri Portal for ArcGIS authorization flaw (CVE‑2026‑33519) and offers guidance on how to respond, likely including patching or other mitigations.

Kaitan ID Security[verified]@KaitanSecurityDisclosure

The text announces a critical authorization flaw (CVE-2026-33519) in Esri Portal for ArcGIS 11.4–12.0 across multiple platforms, with a CVSS score of 9.8 and no patch available yet.

ケイ | IT・セキュリティ系副業Webライター@Teeeda_workerGeneral

The post is a brief notice linking to a blog article that provides an overview of CVE‑2026‑33519 for Esri Portal for ArcGIS, with no detailed technical information, exploit code, or evidence of active exploitation.

Infoflowcloud@infoflowcloudGeneral

The post simply announces CVE-2026-33519 and links to the CVE record, with no additional technical or exploit information.

CVE@CVEnewDisclosure

The post announces that CVE‑2026‑33519 is an authorization flaw in Esri Portal for ArcGIS across multiple versions, with no evidence of exploitation or patch information.

0day Signal@0dayPublishingDisclosure

A new CVE‑2026‑33519 has been highlighted, detailing a privilege escalation flaw in GIS infrastructure that allows developer credentials to bypass authentication, with a link to a zero‑day signal report.