Which versions of Google SecOps are affected by EUVD-2026-60060?

Google SecOps (Chronicle SOAR) contained a critical blind SQL injection vulnerability (CVE-2026-15623, CVSS 9.4) enabling authenticated users to execute arbitrary queries against the backend…. A patch is available.

How to fix or mitigate EUVD-2026-60060?

Within 24 hours, verify that patch version 6.3.85 has been successfully applied to your Chronicle SOAR instances through your Google Cloud console (this patch is deployed automatically by Google and requires no customer action). Within 7 days, audit all user accounts with access to Chronicle SOAR, enforce multi-factor authentication for all users, and restrict administrative privileges to only necessary personnel. Within 30 days, implement continuous monitoring of database access logs and configure alerts to detect any unauthorized or anomalous SQL queries.

Google SecOps EUVD-2026-60060

Q: What is the CVSS score of EUVD-2026-60060?

EUVD-2026-60060 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear. EPSS exploitation probability: 0.2%.

| CVE-2026-15623 CRITICAL

SQL Injection (CWE-89)

2026-08-17 GoogleCloud

GHSA-8f9j-vmpc-422v

SQLi Google Google Secops Chronicle Soar Google Cloud

9.4

CVSS 4.0 · Vendor: GoogleCloud

Severity by source

Vendor (GoogleCloud) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear

vuln.today AI

8.3 HIGH

Network-reachable authenticated endpoint gives AV:N/AC:L/PR:L; blind SQLi yields full DB read/write (C:H/I:H) with limited direct availability impact (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GoogleCloud).

CVSS VectorVendor: GoogleCloud

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVE Published

Aug 17, 2026 - 12:38 cve.org

CRITICAL 9.4

Analysis Generated

Aug 17, 2026 - 12:38 vuln.today

Patch available

Aug 17, 2026 - 07:16 EUVD

DescriptionCVE.org

A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter.

This vulnerability was patched in version 6.3.85, and no customer action is needed.

AnalysisAI

Blind SQL injection in Google SecOps (Chronicle SOAR) versions before 6.3.85 lets an authenticated user abuse a crafted request parameter in a legacy dashboard widget API to run arbitrary blind SQL queries against the backend database. CVSS 4.0 rates it 9.4 (critical) with a low-privilege network vector; no public exploit is identified at time of analysis and it is not listed in CISA KEV. Because the platform is a Google Cloud-managed SaaS, the fix was deployed by the vendor and no customer action is required.

Technical ContextAI

Google SecOps (formerly Chronicle SOAR, originally Siemplify) is Google Cloud's security orchestration, automation and response platform used by SOC teams to run playbooks, manage cases and build dashboards. The flaw is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) in a legacy dashboard widget API endpoint, where a request parameter is concatenated into a SQL statement without proper parameterization. The 'blind' nature means query results are not returned directly in the HTTP response; an attacker instead infers data via boolean or time-based inference. The single CPE, cpe:2.3:a:google_cloud:google_secops_(chronicle_soar), confirms the affected component is the hosted SaaS application layer rather than an on-prem library shipped to customers.

RemediationAI

Vendor-released patch: 6.3.85. Because Google SecOps is a Google Cloud-managed SaaS platform, Google states the fix was applied server-side and no customer action is needed; customers should simply confirm their tenant is running 6.3.85 or later via the release notes at https://docs.cloud.google.com/chronicle/docs/soar/release-notes#May_23_2026. As defense-in-depth for the pre-patch exposure window, tighten SOAR account provisioning and review who holds authenticated tenant access, since exploitation requires a valid low-privileged account; audit dashboard widget API access logs for anomalous or time-based query patterns and rotate any credentials suspected of misuse. No customer-side configuration workaround is applicable given the hosted delivery model.