What is the CVSS score of EUVD-2026-88214?

EUVD-2026-88214 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/U:Clear. EPSS exploitation probability: 0.3%.

How to fix or mitigate EUVD-2026-88214?

Within 24 hours, confirm with Google Cloud support or the Cloud Console release notes that your Application Integration tenant is running a build dated 2026-06-30 or later, and treat any tenant still on an earlier build as unmitigated; simultaneously pull audit logs for EmailTask activity over the past 30 days and look for attachment file paths that reference internal or unexpected directories. Within 7 days, inventory every integration, project, and identity that has been granted EmailTask permissions, remove that permission from any account that does not have a documented business need, and rotate credentials or service account keys for any principal that was over-provisioned; where EmailTask cannot be removed, isolate it into a dedicated integration with tightly scoped data access and alerting on any outbound attachment retrieval. Within 30 days, formalize a control requiring periodic review of Application Integration component-level permissions, enable centralized logging and anomaly detection on integration egress, and confirm remediation in writing with the vendor for any tenant that was confirmed running a pre-2026-06-30 version, since no customer-deployable patch was identified at time of analysis and the vendor-reported server-side fix applied on 2026-06-30 is the only remediation known.

Google Application Integration EUVD-2026-88214

Q: Which versions of Google Application Integration are affected by EUVD-2026-88214?

A high-severity confused deputy flaw in Google Cloud Application Integration's EmailTask component (versions prior to 2026-06-30) allows any low-privilege authenticated user with access to that…. A patch is available.

| CVE-2026-81375 HIGH

Externally Controlled Reference to a Resource in Another Sphere (CWE-610)

2026-09-28 f45cbf4e-4146-4068-b7e1-655ffc2c548c

GHSA-h3ww-47qh-gvv3

Information Disclosure Google

8.3

CVSS 4.0 · Vendor: f45cbf4e-4146-4068-b7e1-655ffc2c548c

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate to Google Cloud Application Integration
Delivery

Configure EmailTask with crafted attachment file path
Exploit

Service resolves path with its own privileges (confused deputy)
Execution

Read arbitrary Google-internal files
Impact

Exfiltrate internal file contents via email attachment

Vulnerability Assessment

Weakness	CWE CWE-610 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V4 - API and Web Service External resource reference control
Exploitation Conditions	Requires an authenticated principal with access to the EmailTask component of Google Cloud Application Integration (PR:L) able to define/edit an integration task and supply a crafted attachment file path; no user interaction is needed. Exploitation is limited to versions prior to 2026-06-30 - because this is a Google-managed SaaS service, the 2026-06-30 server-side patch is applied universally and no customer-side vulnerable configuration persists, so no self-hosted or unpatched instances remain exploitable.
Impact	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/SC:H, base 8.3) describes a network-reachable, low-complexity confused-deputy flaw requiring only low-privilege authentication and no user interaction, with high confidentiality impact on both the vulnerable and a subsequent system (SC:H) - consistent with the service's identity boundary being abused to read Google-internal files. However, several risk-reducing signals dominate: there is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so this is not confirmed exploited and no exploit code is known. Most importantly, Google states the flaw was patched server-side on 2026-06-30 with no customer action required - because Application Integration is a fully-managed GCP SaaS service, the fix is universally deployed and no vulnerable instances remain in customer control. Net: a genuinely serious confidentiality/confused-deputy issue in design terms, but effective real-world risk today is low-to-negligible because it is fully remediated at the provider and was never shown to be exploited. No conflicting signals in the data, though the description does not enumerate exactly which 'Google-internal files' were reachable, so the concrete blast radius is vendor-asserted rather than independently verifiable.
Exploit ScenarioDerived	An authenticated Google Cloud customer with access to Application Integration configures an EmailTask and supplies a crafted attachment file path that points at Google-internal resources rather than the customer's own data. The service, acting as a confused deputy with its own elevated privileges, reads and attaches those internal files, exfiltrating them to the attacker. No public exploit code is identified at time of analysis, and the flaw is patched server-side as of 2026-06-30.

Monitor Track and reassess. Why: Vendor states no customer action required.

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 28, 2026

An authenticated user with access to the EmailTask component in Google Cloud Application Integration (versions prior to 2026-06-30) can exploit a confused deputy weakness to read and exfiltrate arbitrary Google-internal files by supplying a crafted attachment file path. The flaw requires low-privilege authentication (PR:L) and no user interaction, with high confidentiality impact (C:H) on both the service and a subsequent system (SC:H). No public exploit code or active exploitation has been identified at time of analysis; the issue was patched server-side on 2026-06-30, so no customer action is required.

RemediationAI

Google applied the fix server-side on 2026-06-30, and no customer action is required. Because the affected product is a fully managed SaaS platform, there is no customer-side patch to install or configuration to change; all instances were automatically updated. For verification or additional details, refer to the vendor security bulletins at https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-066 and https://docs.cloud.google.com/support/bulletins#gcp-2026-066. If any hypothetical self-managed or hybrid deployment of Application Integration existed, upgrading to the 2026-06-30 or later release would be necessary, but per the vendor, no such deployments are affected. No workarounds are needed, and no other compensating controls are required because the patched service is universal.

Affected VersionsENISA

Application Integration 0 <2026-06-30

Affected Packages

euvd application_integration fix: 2026-06-30

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Google Cloud Application Integration is a fully managed iPaaS (integration platform as a service) that allows users to create integrations using pre-built tasks, including an EmailTask component for handling email attachments. The vulnerability is classified as CWE-610 (Externally Controlled Reference to a Resource in Another Sphere), a confused deputy weakness where the service fails to properly validate or restrict a user-supplied file path, causing the service's own privileged identity to access Google-internal files on behalf of the attacker. Because the component runs with elevated internal permissions, an authenticated attacker who can define or edit an integration task can craft an attachment path that references files outside the intended directory, leading to information disclosure. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/SC:H) indicates network reachability, low attack complexity, low-privilege authentication, no user interaction, and high confidentiality impact on both the vulnerable system and a subsequent system, consistent with the abused identity boundary. No CPE data is available, but the affected product is the SaaS offering, and the fix is a server-side patch.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (f45cbf4e-4146-4068-b7e1-655ffc2c548c) PRIMARY 8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/U:Clear

vuln.today AI 7.7 HIGH

Authenticated low-priv attacker over network (PR:L), no UI; confused deputy reads Google-internal files across a trust boundary so S:C and C:H, with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (f45cbf4e-4146-4068-b7e1-655ffc2c548c).

CVSS VectorVendor: f45cbf4e-4146-4068-b7e1-655ffc2c548c

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

None

Vulnerable system: Availability

None

Subsequent system: Confidentiality

High

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Sep 28, 2026 - 12:16 EUVD

CVE Published

Sep 28, 2026 - 11:16 cve.org

HIGH 8.3

DescriptionCVE.org

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path.

This vulnerability was patched on 30 June 2026, and no customer action is needed.

Executive ViewAI

Why It Matters

A high-severity confused deputy flaw in Google Cloud Application Integration's EmailTask component (versions prior to 2026-06-30) allows any low-privilege authenticated user with access to that component to read and exfiltrate arbitrary Google-internal files by supplying a crafted attachment path. Google has already remediated the issue server-side, so customers running the managed service are not required to deploy anything, but any organization that grants broad EmailTask access to developers or integration builders should treat this as a privilege-boundary failure that could expose sensitive data outside the intended tenant scope. Leadership should care because the exposure is silent, requires no user interaction, and spans both the vulnerable service and a downstream system, making detection dependent on log review rather than user reports.

Business Impact: High

Compensating Controls

No customer-deployable patch was provided; the vendor reports a server-side fix applied 2026-06-30, so interim mitigations focus on limiting blast radius: restrict EmailTask access to least privilege and only documented accounts, remove the component from integrations that do not require it, review and monitor audit logs and outbound attachment activity for crafted or internal file paths, and alert on anomalous data egress until tenant version status is confirmed with the vendor.

Threat Intelligence Overview

EPSS Score

0.3%

Top 78% exploitable

Prevalence

Low

niche managed iPaaS service within Google Cloud, limited adoption

Service Type

Hosted

Vendor-managed, no client patch needed

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

Vendor states no customer action required

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +42

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.