"},{"ID":3911,"user_firstname":"Michael","user_lastname":"Young","nickname":"Michael Young","user_nicename":"myoung1000","display_name":"Michael Young","user_email":"myoung@esri.com","user_url":"http:\/\/trust.arcgis.com","user_registered":"2018-03-02 00:15:29","user_description":"","user_avatar":"
"},{"ID":5311,"user_firstname":"Randall","user_lastname":"Williams","nickname":"Randall Williams","user_nicename":"randallwilliams","display_name":"Randall Williams","user_email":"randall_williams@esri.com","user_url":"https:\/\/trust.arcgis.com","user_registered":"2018-03-02 00:17:03","user_description":"","user_avatar":"
"}],"short_description":"Esri has released updates to address critical developer credential vulnerabilities in ArcGIS products.","flexible_content":[{"acf_fc_layout":"sidebar","content":"Key highlights<\/strong><\/p>\n Esri has discovered a security vulnerability with developer credentials affecting ArcGIS Online, ArcGIS Location Platform and ArcGIS Enterprise.<\/p>\n <\/p>\n Both were patched on 4\/13\/26, and only affected customers notified asking them to validate that the update did not affect their applications and scripts using developer credentials.<\/p>\n <\/p>\n UPDATE 4\/14 – PATCH ISSUE – Web Tier Authentication deployments will fail when patch applied.\u00a0 Patch downloads have been temporarily disabled and update patch made available soon.<\/strong><\/p>\n Security patch released concurrently on 4\/13\/2026, resolving 2 critical severity<\/strong> vulnerabilities in Portal for ArcGIS 11.5 and 12.0 – It should be installed with the highest priority.\u00a0 The patch resets potentially over-scoped developer credentials created by Portal for ArcGIS 11.5 back to expected default permissions.\u00a0 This is not expected to disrupt most customer developer credential use cases, however the patch should be executed during an off-business hour period to minimize potential operational disruption.\u00a0 Uninstalling the patch will NOT undo the permission changes of your developer credentials<\/em>, so please backup your systems as recommended.<\/p>\n <\/p>\n If your organization does not utilize any developer credentials, including API keys or OAuth 2.0 credentials for application authentication, your system is not vulnerable.\u00a0 If your organization is unable to apply this patch in a timely manner and you currently utilize developer credentials, we recommend invalidating the developer credentials<\/a> until the patch can be applied.<\/p>\n <\/p>\n Browse to Organization settings \/ Security \/ Developer Credentials.\u00a0 If there are API keys or OAuth 2.0 credentials you have Developer Credentials.<\/p>\n <\/p>\n If the reset of over-scoped developer credentials disrupts your script or app we recommend the following steps to resolve:<\/p>\n <\/p>\n Esri and the software industry are moving away from using API keys for protecting sensitive content due to the inherent security risks they present.\u00a0 Esri has recently updated developer credential documentation and posted\/updated the following ArcGIS Trust Center content:<\/p>\n <\/p>\n"},{"acf_fc_layout":"content","content":" CVE-2026-33518<\/strong><\/em><\/a><\/p>\n CVE-2026-33519<\/strong><\/em><\/a><\/p>\n\n
ArcGIS Online and ArcGIS Location Platform<\/strong><\/h4>\n
ArcGIS Enterprise<\/strong><\/h4>\n
\n
Mitigation<\/strong><\/h4>\n
Developer Credential Check<\/strong><\/h4>\n
Troubleshooting<\/b><\/h4>\n
\n
\nExample: curl https:\/\/www.arcgis.com\/sharing\/rest\/community\/self?f=pjson&token=[Your_API_Key]<\/a><\/em><\/li>\nBest Practice<\/strong><\/h4>\n
\n
ArcGIS Enterprise Vulnerability Details<\/strong><\/h4>\n
\n
\n