EUVD-2026-60060
GHSA-8f9j-vmpc-422v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Network-reachable authenticated endpoint gives AV:N/AC:L/PR:L; blind SQLi yields full DB read/write (C:H/I:H) with limited direct availability impact (A:L).
Primary rating from Vendor (GoogleCloud).
CVSS VectorVendor: GoogleCloud
Lifecycle Timeline
3DescriptionCVE.org
A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter.
This vulnerability was patched in version 6.3.85, and no customer action is needed.
AnalysisAI
Blind SQL injection in Google SecOps (Chronicle SOAR) versions before 6.3.85 lets an authenticated user abuse a crafted request parameter in a legacy dashboard widget API to run arbitrary blind SQL queries against the backend database. CVSS 4.0 rates it 9.4 (critical) with a low-privilege network vector; no public exploit is identified at time of analysis and it is not listed in CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated Google SecOps (Chronicle SOAR) account (CVSS PR:L) and access to the legacy dashboard widget API endpoint; exploitation is performed by supplying a crafted request parameter that is injected into a blind SQL query. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 9.4 reflects a network-reachable, low-complexity attack requiring only low privileges (PR:L) and no user interaction, with High confidentiality, integrity and availability impact on both the vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 6.3.85. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify that patch version 6.3.85 has been successfully applied to your Chronicle SOAR instances through your Google Cloud console (this patch is deployed automatically by Google and requires no customer action). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Google Secops Chronicle Soar
View allSame weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today