CVE-2026-12710: falha crítica em Google Cloud Application Integration
Missing Authorization in Application Integration QueryEngineTask
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.4%
A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration (versions from 2025-04-28 to 2026-04-04) allows an external attacker to access sensitive internal data.
The issue was patched on April 4, 2026; no customer action is required.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Clear
Produtos afetados
Google Cloud · Application IntegrationCVEs relacionadas — Google Cloud Application Integration
No mesmo produto, das mais perigosas para as menos.
CVE-2026-93327CRITICALUnsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code ExecutionEPSS 0.4%CVE-2026-85298HIGHImproper Authorization in Google Cloud Application Integration Leads to Privilege EscalationEPSS 0.4%CVE-2026-81867CRITICALDeserialization of Untrusted Data in Application Integration allows Remote Code ExecutionEPSS 0.4%CVE-2026-81375HIGHConfused Deputy in Application Integration allows Internal File ReadEPSS 0.3%CVE-2025-0982CRITICALSandbox Escape in Google Cloud Application Integration's JavaScript Task (Rhino Engine)EPSS 0.3%CVE-2026-19759CRITICALIncorrect Authorization in Application Integration allows Internal Stubby RPC ExecutionEPSS 0.2%