This vulnerability (CVE-2026-33518) in Esri Portal for ArcGIS 11.5 allows highly privileged users to create developer credentials with excessive privileges due to incorrect privilege assignment (CWE-266). The issue affects both Windows and Linux deployments of the product. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required to exploit, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by Esri at this time, and no known exploits have been reported.

If exploited, this vulnerability could allow a highly privileged user to escalate privileges beyond intended limits by creating developer credentials with excessive permissions. This could compromise the confidentiality, integrity, and availability of the affected system. Since the vulnerability exists in a critical enterprise GIS platform, the impact could be significant in environments relying on Portal for ArcGIS for spatial data management and services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should restrict access to highly privileged accounts to trusted personnel only and monitor for any unusual creation of developer credentials. No official mitigation or temporary fix has been provided by Esri as of the published date.