Application Integration EUVD-2026-64241

Exploitation targets the QueryEngineTask component of Google Cloud Application Integration and requires no authentication, no privileges, and no user interaction (CVSS PR:N/UI:N/AC:L/AV:N), meaning it applied to reachable deployments of the service without special tenant configuration during the affected window. The primary limiting factors are temporal and platform-bound: only service versions from 2025-04-28 to 2026-04-04 were vulnerable, the flaw was reachable only through the specific QueryEngineTask path, and because this is a Google-managed service the fix was deployed centrally on 2026-04-04, closing the window for all tenants without customer intervention.

The signals are moderately aligned toward high severity but incomplete. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H) describes trivial, unauthenticated, low-complexity network access with high confidentiality AND integrity impact, yielding 9.3 - a genuinely serious profile for a data-access flaw. However, the description only states that an attacker can 'access sensitive internal data' (a read/confidentiality outcome) and does not substantiate the VI:H integrity claim, so there is a discrepancy between the narrative and the scored vector that should be verified with Google. No EPSS score, KEV entry, POC, or SSVC decision data was provided; absent those, exploitation likelihood cannot be quantified, and the class of bug (missing authorization on a reachable endpoint) is the kind that is often automatable if a request path is known. Because this is a fully managed cloud service that Google states is already patched with no customer action required, real-world residual risk to current tenants is low even though the pre-fix window (roughly a year) was high-impact; any organization that used the service during that window should treat the historical exposure of internal data as a potential-disclosure event and review whether sensitive data was reachable.

An external attacker who can reach the Application Integration service sends a request that invokes a QueryEngineTask code path lacking an authorization check, retrieving internal data belonging to a tenant without any credentials or user interaction. Because the CVSS vector indicates network vector and low complexity with no privileges required, the request could be issued directly over the network; no public POC has been identified at time of analysis.