{"schema_version":"2","view":"grouped","data":[{"id":22126,"cve_ids":["CVE-2026-85298"],"payload":{"kind":"advisory","title":"Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation","summary":"An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was patched on 27 August 2026, and no customer action is needed.","evidence":"cve:CVE-2026-85298","products":[{"name":{"value":"Application Integration","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-85298","aliases":["CVE-2026-85298"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/U:Clear","exploitMaturity":"NOT_DEFINED","providerUrgency":"CLEAR","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Google Cloud","product":"Application Integration","versions":[{"status":"affected","version":"0","lessThan":"2026-08-27","versionType":"date"}],"defaultStatus":"unaffected"}],"modified":"2026-10-14T14:04:02.404Z","provider":"cve","references":["https://docs.cloud.google.com/support/bulletins#gcp-2026-068","https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-068"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85298","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T14:03:51.836700Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T14:04:02.404Z"}}],"cna":{"orgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","shortName":"GoogleCloud","dateUpdated":"2026-10-14T11:14:00.566Z"}}},"related_cves":[{"value":"CVE-2026-85298","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cefb567e-06f0-484e-a1a5-8f92707f9f60","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85298","advisory_id":"cefb567e-06f0-484e-a1a5-8f92707f9f60","event_types":["advisory"],"published_at":"2026-10-25T05:54:01.192101+00:00","technologies":["application-integration","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T11:14:00.566+00:00","detail_url":"/advisories/advisory%3Acefb567e-06f0-484e-a1a5-8f92707f9f60","group":{"id":"advisory:cefb567e-06f0-484e-a1a5-8f92707f9f60","revision":1,"primary_event_id":21969,"change":"published","superseded_by":[],"changed":{"id":21969,"cve_ids":["CVE-2026-85298"],"payload":{"kind":"advisory","title":"Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation","summary":"An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was patched on 27 August 2026, and no customer action is needed.","evidence":"cve:CVE-2026-85298","products":[{"name":{"value":"Application Integration","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-85298","aliases":["CVE-2026-85298"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/U:Clear","exploitMaturity":"NOT_DEFINED","providerUrgency":"CLEAR","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Google Cloud","product":"Application Integration","versions":[{"status":"affected","version":"0","lessThan":"2026-08-27","versionType":"date"}],"defaultStatus":"unaffected"}],"modified":"2026-10-14T14:04:02.404Z","provider":"cve","references":["https://docs.cloud.google.com/support/bulletins#gcp-2026-068","https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-068"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85298","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T14:03:51.836700Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T14:04:02.404Z"}}],"cna":{"orgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","shortName":"GoogleCloud","dateUpdated":"2026-10-14T11:14:00.566Z"}}},"related_cves":[{"value":"CVE-2026-85298","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cefb567e-06f0-484e-a1a5-8f92707f9f60","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85298","advisory_id":"cefb567e-06f0-484e-a1a5-8f92707f9f60","event_types":["advisory"],"published_at":"2026-10-25T05:54:01.192101+00:00","technologies":["application-integration","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T11:14:00.566+00:00","detail_url":"/events/21969"},"members":[{"id":21969,"cve_ids":["CVE-2026-85298"],"payload":{"kind":"advisory","title":"Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation","summary":"An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was patched on 27 August 2026, and no customer action is needed.","evidence":"cve:CVE-2026-85298","products":[{"name":{"value":"Application Integration","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-85298","aliases":["CVE-2026-85298"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/U:Clear","exploitMaturity":"NOT_DEFINED","providerUrgency":"CLEAR","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Google Cloud","product":"Application Integration","versions":[{"status":"affected","version":"0","lessThan":"2026-08-27","versionType":"date"}],"defaultStatus":"unaffected"}],"modified":"2026-10-14T14:04:02.404Z","provider":"cve","references":["https://docs.cloud.google.com/support/bulletins#gcp-2026-068","https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-068"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85298","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T14:03:51.836700Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T14:04:02.404Z"}}],"cna":{"orgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","shortName":"GoogleCloud","dateUpdated":"2026-10-14T11:14:00.566Z"}}},"related_cves":[{"value":"CVE-2026-85298","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cefb567e-06f0-484e-a1a5-8f92707f9f60","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85298","advisory_id":"cefb567e-06f0-484e-a1a5-8f92707f9f60","event_types":["advisory"],"published_at":"2026-10-25T05:54:01.192101+00:00","technologies":["application-integration","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T11:14:00.566+00:00","detail_url":"/events/21969"}]}},{"id":4203,"cve_ids":["CVE-2026-81867"],"payload":{"kind":"advisory","title":"Deserialization of Untrusted Data in Application Integration allows Remote Code Execution","summary":"A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially crafted script bypassing param guards. This vulnerability was patched on 28 June 2026, and no customer action is needed.","evidence":"cve:CVE-2026-81867","products":[{"name":{"value":"Application Integration","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-81867","aliases":["CVE-2026-81867"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.4,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear","exploitMaturity":"NOT_DEFINED","providerUrgency":"CLEAR","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Google Cloud","product":"Application Integration","versions":[{"status":"affected","version":"0","lessThan":"2026-06-28","versionType":"date"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T13:15:05.236Z","provider":"cve","references":["https://docs.cloud.google.com/support/bulletins#gcp-2026-065","https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-065"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-81867","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-30T13:13:46.786446Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T13:15:05.236Z"}}],"cna":{"orgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","shortName":"GoogleCloud","dateUpdated":"2026-09-28T10:49:16.416Z"}}},"related_cves":[{"value":"CVE-2026-81867","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e527131f-1951-4b8a-a7cc-784ca18326b1","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-81867","advisory_id":"e527131f-1951-4b8a-a7cc-784ca18326b1","event_types":["advisory"],"published_at":"2026-10-24T21:48:12.620095+00:00","technologies":["application-integration","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T10:49:16.416+00:00","detail_url":"/advisories/advisory%3Ae527131f-1951-4b8a-a7cc-784ca18326b1","group":{"id":"advisory:e527131f-1951-4b8a-a7cc-784ca18326b1","revision":1,"primary_event_id":4218,"change":"published","superseded_by":[],"changed":{"id":4218,"cve_ids":["CVE-2026-81867"],"payload":{"kind":"advisory","title":"Deserialization of Untrusted Data in Application Integration allows Remote Code Execution","summary":"A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially crafted script bypassing param guards. This vulnerability was patched on 28 June 2026, and no customer action is needed.","evidence":"cve:CVE-2026-81867","products":[{"name":{"value":"Application Integration","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-81867","aliases":["CVE-2026-81867"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.4,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear","exploitMaturity":"NOT_DEFINED","providerUrgency":"CLEAR","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Google Cloud","product":"Application Integration","versions":[{"status":"affected","version":"0","lessThan":"2026-06-28","versionType":"date"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T13:15:05.236Z","provider":"cve","references":["https://docs.cloud.google.com/support/bulletins#gcp-2026-065","https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-065"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-81867","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-30T13:13:46.786446Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T13:15:05.236Z"}}],"cna":{"orgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","shortName":"GoogleCloud","dateUpdated":"2026-09-28T10:49:16.416Z"}}},"related_cves":[{"value":"CVE-2026-81867","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e527131f-1951-4b8a-a7cc-784ca18326b1","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-81867","advisory_id":"e527131f-1951-4b8a-a7cc-784ca18326b1","event_types":["advisory"],"published_at":"2026-10-24T21:48:12.620095+00:00","technologies":["application-integration","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T10:49:16.416+00:00","detail_url":"/events/4218"},"members":[{"id":4218,"cve_ids":["CVE-2026-81867"],"payload":{"kind":"advisory","title":"Deserialization of Untrusted Data in Application Integration allows Remote Code Execution","summary":"A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially crafted script bypassing param guards. This vulnerability was patched on 28 June 2026, and no customer action is needed.","evidence":"cve:CVE-2026-81867","products":[{"name":{"value":"Application Integration","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-81867","aliases":["CVE-2026-81867"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.4,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear","exploitMaturity":"NOT_DEFINED","providerUrgency":"CLEAR","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Google Cloud","product":"Application Integration","versions":[{"status":"affected","version":"0","lessThan":"2026-06-28","versionType":"date"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T13:15:05.236Z","provider":"cve","references":["https://docs.cloud.google.com/support/bulletins#gcp-2026-065","https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-065"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-81867","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-30T13:13:46.786446Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T13:15:05.236Z"}}],"cna":{"orgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","shortName":"GoogleCloud","dateUpdated":"2026-09-28T10:49:16.416Z"}}},"related_cves":[{"value":"CVE-2026-81867","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e527131f-1951-4b8a-a7cc-784ca18326b1","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-81867","advisory_id":"e527131f-1951-4b8a-a7cc-784ca18326b1","event_types":["advisory"],"published_at":"2026-10-24T21:48:12.620095+00:00","technologies":["application-integration","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T10:49:16.416+00:00","detail_url":"/events/4218"}]}},{"id":3313,"cve_ids":["CVE-2026-19759"],"payload":{"kind":"advisory","title":"Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution","summary":"An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside Google's production network under a privileged identity using an internal-only task type. This vulnerability was patched on 17 June 2026, and no customer action is needed.","evidence":"cve:CVE-2026-19759","products":[{"name":{"value":"Application Integration","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-19759","aliases":["CVE-2026-19759"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.4,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear","exploitMaturity":"NOT_DEFINED","providerUrgency":"CLEAR","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Google Cloud","product":"Application Integration","versions":[{"status":"affected","version":"0","lessThan":"2026-06-17","versionType":"date"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T19:29:52.655Z","provider":"cve","references":["https://docs.cloud.google.com/support/bulletins#gcp-2026-064","https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-064"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19759","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T19:29:37.898572Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T19:29:52.655Z"}}],"cna":{"orgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","shortName":"GoogleCloud","dateUpdated":"2026-09-28T10:34:51.761Z"}}},"related_cves":[{"value":"CVE-2026-19759","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:29f03485-155c-4b0c-b230-9ca274fdf233","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19759","advisory_id":"29f03485-155c-4b0c-b230-9ca274fdf233","event_types":["advisory"],"published_at":"2026-10-24T21:33:36.006102+00:00","technologies":["application-integration","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T10:34:51.761+00:00","detail_url":"/advisories/advisory%3A29f03485-155c-4b0c-b230-9ca274fdf233","group":{"id":"advisory:29f03485-155c-4b0c-b230-9ca274fdf233","revision":1,"primary_event_id":3326,"change":"published","superseded_by":[],"changed":{"id":3326,"cve_ids":["CVE-2026-19759"],"payload":{"kind":"advisory","title":"Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution","summary":"An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside Google's production network under a privileged identity using an internal-only task type. This vulnerability was patched on 17 June 2026, and no customer action is needed.","evidence":"cve:CVE-2026-19759","products":[{"name":{"value":"Application Integration","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-19759","aliases":["CVE-2026-19759"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.4,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear","exploitMaturity":"NOT_DEFINED","providerUrgency":"CLEAR","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Google Cloud","product":"Application Integration","versions":[{"status":"affected","version":"0","lessThan":"2026-06-17","versionType":"date"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T19:29:52.655Z","provider":"cve","references":["https://docs.cloud.google.com/support/bulletins#gcp-2026-064","https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-064"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19759","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T19:29:37.898572Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T19:29:52.655Z"}}],"cna":{"orgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","shortName":"GoogleCloud","dateUpdated":"2026-09-28T10:34:51.761Z"}}},"related_cves":[{"value":"CVE-2026-19759","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:29f03485-155c-4b0c-b230-9ca274fdf233","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19759","advisory_id":"29f03485-155c-4b0c-b230-9ca274fdf233","event_types":["advisory"],"published_at":"2026-10-24T21:33:36.006102+00:00","technologies":["application-integration","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T10:34:51.761+00:00","detail_url":"/events/3326"},"members":[{"id":3326,"cve_ids":["CVE-2026-19759"],"payload":{"kind":"advisory","title":"Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution","summary":"An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside Google's production network under a privileged identity using an internal-only task type. This vulnerability was patched on 17 June 2026, and no customer action is needed.","evidence":"cve:CVE-2026-19759","products":[{"name":{"value":"Application Integration","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-19759","aliases":["CVE-2026-19759"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.4,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear","exploitMaturity":"NOT_DEFINED","providerUrgency":"CLEAR","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Google Cloud","product":"Application Integration","versions":[{"status":"affected","version":"0","lessThan":"2026-06-17","versionType":"date"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T19:29:52.655Z","provider":"cve","references":["https://docs.cloud.google.com/support/bulletins#gcp-2026-064","https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-064"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19759","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T19:29:37.898572Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T19:29:52.655Z"}}],"cna":{"orgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","shortName":"GoogleCloud","dateUpdated":"2026-09-28T10:34:51.761Z"}}},"related_cves":[{"value":"CVE-2026-19759","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:29f03485-155c-4b0c-b230-9ca274fdf233","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19759","advisory_id":"29f03485-155c-4b0c-b230-9ca274fdf233","event_types":["advisory"],"published_at":"2026-10-24T21:33:36.006102+00:00","technologies":["application-integration","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T10:34:51.761+00:00","detail_url":"/events/3326"}]}},{"id":3082,"cve_ids":["CVE-2026-81375"],"payload":{"kind":"advisory","title":"Confused Deputy in Application Integration allows Internal File Read","summary":"A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability was patched on 30 June 2026, and no customer action is needed.","evidence":"cve:CVE-2026-81375","products":[{"name":{"value":"Application Integration","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-81375","aliases":["CVE-2026-81375"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/U:Clear","exploitMaturity":"NOT_DEFINED","providerUrgency":"CLEAR","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Google Cloud","product":"Application Integration","versions":[{"status":"affected","version":"0","lessThan":"2026-06-30","versionType":"date"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T13:31:29.289Z","provider":"cve","references":["https://docs.cloud.google.com/support/bulletins#gcp-2026-066","https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-066"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-81375","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T13:04:42.553100Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T13:31:29.289Z"}}],"cna":{"orgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","shortName":"GoogleCloud","dateUpdated":"2026-09-28T10:58:46.532Z"}}},"related_cves":[{"value":"CVE-2026-81375","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ba783168-d165-465b-a7d1-5907acae2a9b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-81375","advisory_id":"ba783168-d165-465b-a7d1-5907acae2a9b","event_types":["advisory"],"published_at":"2026-10-24T21:29:11.449002+00:00","technologies":["application-integration","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T10:58:46.532+00:00","detail_url":"/advisories/advisory%3Aba783168-d165-465b-a7d1-5907acae2a9b","group":{"id":"advisory:ba783168-d165-465b-a7d1-5907acae2a9b","revision":1,"primary_event_id":3086,"change":"published","superseded_by":[],"changed":{"id":3086,"cve_ids":["CVE-2026-81375"],"payload":{"kind":"advisory","title":"Confused Deputy in Application Integration allows Internal File Read","summary":"A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability was patched on 30 June 2026, and no customer action is needed.","evidence":"cve:CVE-2026-81375","products":[{"name":{"value":"Application Integration","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-81375","aliases":["CVE-2026-81375"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/U:Clear","exploitMaturity":"NOT_DEFINED","providerUrgency":"CLEAR","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Google Cloud","product":"Application Integration","versions":[{"status":"affected","version":"0","lessThan":"2026-06-30","versionType":"date"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T13:31:29.289Z","provider":"cve","references":["https://docs.cloud.google.com/support/bulletins#gcp-2026-066","https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-066"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-81375","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T13:04:42.553100Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T13:31:29.289Z"}}],"cna":{"orgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","shortName":"GoogleCloud","dateUpdated":"2026-09-28T10:58:46.532Z"}}},"related_cves":[{"value":"CVE-2026-81375","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ba783168-d165-465b-a7d1-5907acae2a9b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-81375","advisory_id":"ba783168-d165-465b-a7d1-5907acae2a9b","event_types":["advisory"],"published_at":"2026-10-24T21:29:11.449002+00:00","technologies":["application-integration","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T10:58:46.532+00:00","detail_url":"/events/3086"},"members":[{"id":3086,"cve_ids":["CVE-2026-81375"],"payload":{"kind":"advisory","title":"Confused Deputy in Application Integration allows Internal File Read","summary":"A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability was patched on 30 June 2026, and no customer action is needed.","evidence":"cve:CVE-2026-81375","products":[{"name":{"value":"Application Integration","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-81375","aliases":["CVE-2026-81375"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/U:Clear","exploitMaturity":"NOT_DEFINED","providerUrgency":"CLEAR","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Google Cloud","product":"Application Integration","versions":[{"status":"affected","version":"0","lessThan":"2026-06-30","versionType":"date"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T13:31:29.289Z","provider":"cve","references":["https://docs.cloud.google.com/support/bulletins#gcp-2026-066","https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-066"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-81375","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T13:04:42.553100Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T13:31:29.289Z"}}],"cna":{"orgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","shortName":"GoogleCloud","dateUpdated":"2026-09-28T10:58:46.532Z"}}},"related_cves":[{"value":"CVE-2026-81375","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ba783168-d165-465b-a7d1-5907acae2a9b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-81375","advisory_id":"ba783168-d165-465b-a7d1-5907acae2a9b","event_types":["advisory"],"published_at":"2026-10-24T21:29:11.449002+00:00","technologies":["application-integration","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T10:58:46.532+00:00","detail_url":"/events/3086"}]}}],"next_after":22126,"next_before":3082}