Which versions of Integration Connectors are affected by EUVD-2026-70996?

Google Cloud Integration Connectors contain a privilege escalation vulnerability (CVSS 8.5) that allows authenticated low-privilege users to attach unauthorized service accounts and gain complete…. A patch is available.

How to fix or mitigate EUVD-2026-70996?

Within 24 hours, audit the audit logs and access history of all Google Cloud Integration Connectors deployed before 2025-12-11 to identify any unauthorized service account attachment activity. Within 7 days, review and tighten Identity and Access Management (IAM) policies to restrict which principals can attach or modify service accounts on Integration Connectors, enforcing least-privilege access for this sensitive operation. Within 30 days, establish continuous monitoring and automated alerts for service account modifications to Integration Connectors, and conduct a complete permissions review of all service accounts assigned to connectors to eliminate any standing over-privileged configurations.

Integration Connectors EUVD-2026-70996

Q: What is the CVSS score of EUVD-2026-70996?

EUVD-2026-70996 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear. EPSS exploitation probability: 0.2%.

| CVE-2026-4644 HIGH

Incorrect Authorization (CWE-863)

2026-09-04 GoogleCloud

GHSA-vwm5-6ggm-73px

Google Integration Connectors Google Cloud

8.5

CVSS 4.0 · Vendor: GoogleCloud

Severity by source

Vendor (GoogleCloud) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear

vuln.today AI

9.9 CRITICAL

Network-reachable GCP API, low complexity, authenticated low-privilege user required; scope changes to full Google Cloud Project giving C:H/I:H/A:H on subsequent systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Primary rating from Vendor (GoogleCloud).

CVSS VectorVendor: GoogleCloud

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Threat Model Generated

Sep 04, 2026 - 19:31 vuln.today

Patch available

Sep 04, 2026 - 12:16 EUVD

Metadata Corrected

Sep 04, 2026 - 11:40 vuln.today

tag: Authentication Bypass replaced by Privilege Escalation

POC Analysis Generated

Sep 04, 2026 - 11:20 vuln.today

Analysis Generated

Sep 04, 2026 - 10:52 vuln.today

CVE Published

Sep 04, 2026 - 10:19 cve.org

HIGH 8.5

DescriptionCVE.org

A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment.

This vulnerability was patched on 11 December 2025, and no customer action is needed.

AnalysisAI

Privilege escalation in Google Cloud Integration Connectors (HTTP Connector component) allows an authenticated low-privilege user to attach an unauthorized service account to a connector, effectively taking over the associated Google Cloud Project. Affected versions are those deployed prior to the 2025-12-11 server-side patch, which Google applied automatically with no customer action required. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid GCP identity with at minimum low-level authenticated access to the target Google Cloud Project - no anonymous or unauthenticated exploitation is possible. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 8.5 and accurately reflects the network-reachable attack surface with low attack complexity and no required user interaction, though authentication as a low-privilege user (PR:L) is a necessary prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Google has fully remediated this vulnerability server-side as of 2025-12-11; no customer action is required. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit the audit logs and access history of all Google Cloud Integration Connectors deployed before 2025-12-11 to identify any unauthorized service account attachment activity. …

Threat intelligence, references, and detailed analysis are available after sign-in.