Which versions of Google SecOps are affected by EUVD-2026-53390?

Chronicle SOAR versions prior to 6.3.85 contain a critical privilege escalation vulnerability (CVSS 9.4) that allows authenticated users to elevate to administrative access.. A patch is available.

How to fix or mitigate EUVD-2026-53390?

Within 24 hours: Identify whether Chronicle SOAR is deployed as Google Cloud-hosted or self-hosted, and verify the current version against 6.3.85. Within 7 days: For cloud-hosted systems, confirm patch application with Google Cloud support; for self-hosted systems, implement all compensating controls immediately and request patch availability timeline from Google. Within 30 days: Establish and begin executing upgrade plan to version 6.3.85 or later for all self-hosted deployments, with target completion as soon as patched version is available.

Google SecOps EUVD-2026-53390

Q: What is the CVSS score of EUVD-2026-53390?

EUVD-2026-53390 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear. EPSS exploitation probability: 0.2%.

| CVE-2026-15587 CRITICAL

Origin Validation Error (CWE-346)

2026-08-05 GoogleCloud

GHSA-54qh-3v8w-mm9c

Privilege Escalation Google Google Secops Chronicle Soar Google Cloud

9.4

CVSS 4.0 · Vendor: GoogleCloud

Severity by source

Vendor (GoogleCloud) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear

vuln.today AI

9.9 CRITICAL

Network-reachable API abusable by an authenticated low-privileged user (PR:L) with no interaction; forged internal header crosses a trust boundary (S:C) yielding full admin impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GoogleCloud).

CVSS VectorVendor: GoogleCloud

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 05, 2026 - 16:17 EUVD

Analysis Generated

Aug 05, 2026 - 15:45 vuln.today

CVE Published

Aug 05, 2026 - 14:40 cve.org

CRITICAL 9.4

DescriptionCVE.org

Improper Privilege Management in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to escalate privileges to system-level administrative access using a crafted internal authentication header.

This vulnerability was patched with version 6.3.85, and no customer action is needed.

AnalysisAI

Privilege escalation in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to forge a crafted internal authentication header and elevate from a low-privileged account to system-level administrative access. The flaw stems from improper validation of the origin/trust of an internal auth header (CWE-346), and carries a critical CVSS 4.0 base score of 9.4 driven by high confidentiality, integrity, and availability impact plus a scope change onto subsequent systems. There is no public exploit identified at time of analysis; Google patched the cloud-hosted service transparently and states no customer action is needed.

Technical ContextAI

Google SecOps (formerly Chronicle SOAR) is Google Cloud's Security Orchestration, Automation and Response platform, delivered as a managed SaaS on GCP and used by SOC teams to run playbooks, case management, and integrations. The affected CPE is cpe:2.3:a:google_cloud:google_secops_(chronicle_soar). The root cause is classified as CWE-346 (Origin Validation Error): the application trusts an internal authentication header without adequately verifying that the header genuinely originated from a trusted internal component. Because the header is used to convey privilege/identity between internal services, a user who can craft or inject it can impersonate a system-level administrative principal, bypassing the intended authorization boundary between tenant/user roles and platform-administrative functions.

RemediationAI

Vendor-released patch: version 6.3.85. Because Google SecOps is a managed GCP service, Google deployed the fix to the hosted platform and explicitly states no customer action is needed - tenants are automatically on the patched build. Customers should verify their environment reflects version 6.3.85 or later and review the release notes at https://docs.cloud.google.com/chronicle/docs/soar/release-notes#May_23_2026. As standard hygiene given the flaw was a privilege-escalation path, teams may wish to review SOAR admin-account audit logs and role assignments for anomalous system-level access during the pre-patch window, though no compromise is indicated by the available data; there are no customer-side workarounds to apply since the vulnerable code path was in the vendor-operated backend.