This vulnerability (CVE-2026-33518) in Esri Portal for ArcGIS 11.5 allows highly privileged users to create developer credentials with excessive privileges due to incorrect privilege assignment (CWE-266). The issue affects both Windows and Linux deployments of the product. The CVSS 3.1 score of 9.8 reflects its critical severity, with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. The vendor has published the vulnerability but has not yet provided a remediation level or patch. The vulnerability is not related to a cloud service and no known exploits have been reported.

The vulnerability allows highly privileged users to create developer credentials that may have more privileges than intended, potentially leading to unauthorized privilege escalation. This can compromise the confidentiality, integrity, and availability of the affected system. Since the flaw involves privilege assignment, it could enable attackers with initial high privileges to expand their control over the system beyond expected limits.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should carefully control and monitor the use of highly privileged accounts in Esri Portal for ArcGIS 11.5 and restrict the creation of developer credentials to trusted administrators only. Review and audit privileges assigned to developer credentials to detect any anomalies.