EUVD-2026-53390
GHSA-54qh-3v8w-mm9c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Network-reachable API abusable by an authenticated low-privileged user (PR:L) with no interaction; forged internal header crosses a trust boundary (S:C) yielding full admin impact.
Primary rating from Vendor (GoogleCloud).
CVSS VectorVendor: GoogleCloud
Lifecycle Timeline
3DescriptionCVE.org
Improper Privilege Management in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to escalate privileges to system-level administrative access using a crafted internal authentication header.
This vulnerability was patched with version 6.3.85, and no customer action is needed.
AnalysisAI
Privilege escalation in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to forge a crafted internal authentication header and elevate from a low-privileged account to system-level administrative access. The flaw stems from improper validation of the origin/trust of an internal auth header (CWE-346), and carries a critical CVSS 4.0 base score of 9.4 driven by high confidentiality, integrity, and availability impact plus a scope change onto subsequent systems. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess a valid authenticated account on the Google SecOps (Chronicle SOAR) platform (CVSS PR:L), and to be able to reach the service over the network (AV:N) with no user interaction (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals point to a genuinely high-priority issue but with meaningful mitigating context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: version 6.3.85. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify whether Chronicle SOAR is deployed as Google Cloud-hosted or self-hosted, and verify the current version against 6.3.85. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Google Secops Chronicle Soar
View allSame weakness CWE-346 – Origin Validation Error
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today