Google SecOps CVE-2026-15623

Requires a valid authenticated Google SecOps (Chronicle SOAR) account (CVSS PR:L) and access to the legacy dashboard widget API endpoint; exploitation is performed by supplying a crafted request parameter that is injected into a blind SQL query. Limiting factors: the attacker must already be an authenticated tenant user (there is no unauthenticated path), the vulnerable code path is the specific legacy dashboard widget API rather than the whole product, and only versions prior to 6.3.85 are affected - the vendor-managed SaaS has already been upgraded, closing the window for customers.

The CVSS 4.0 score of 9.4 reflects a network-reachable, low-complexity attack requiring only low privileges (PR:L) and no user interaction, with High confidentiality, integrity and availability impact on both the vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H). The subsequent-system High ratings imply the database access could pivot beyond the immediate widget context, which is plausible for a SOAR platform holding cross-integration case data and secrets. However, exploitation is gated by valid authenticated access (PR:L), which meaningfully narrows the attacker pool to existing tenant users. No EPSS score, no KEV listing and no POC are present in the provided data, so real-world exploitation pressure is currently unproven - the high rating is driven by potential impact, not observed attacks. Because the environment is vendor-managed SaaS already patched at 6.3.85 with no customer action needed, residual real-world risk to customers is low despite the critical score.

An attacker who already holds a valid low-privileged Google SecOps tenant account sends a crafted parameter to the legacy dashboard widget API, injecting boolean or time-based SQL to blindly extract case data, integration secrets or other tenant records from the backend database. No public exploit code is identified, and the network/low-complexity vector means such requests could be automated once a foothold account exists.