Critical 9.8 CVSS Flaws Hit ArcGIS Infrastructure

Esri issued an urgent bulletin for two critical ArcGIS vulnerabilities (CVE-2026-33518 and CVE-2026-33519, CVSS 9.8) that can allow creation of over‑scoped developer credentials and improper authorization checks in Portal for ArcGIS (affecting 11.4, 11.5, and 12.0). ArcGIS Online and Location Platform were patched on April 13, 2026; Portal patches are high priority and include a proactive reset of potentially over‑scoped credentials for certain versions. Administrators should check Organization settings → Security → Developer Credentials, invalidate developer credentials if they cannot immediately patch, and apply the provided Windows, Linux, or Kubernetes updates as applicable.