All vulnerabilities
CVE-2026-19759

Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution

Google Cloud Application Integration
Open in ThreatlineRecord JSON
CVSS
9.4Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2026-06-17Fixed versionCVE List
Published28 Sep 2026Updated 28 Sep 2026CVE List

What fixes it

  • 2026-06-17Application IntegrationCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside Google's production network under a privileged identity using an internal-only task type.

This vulnerability was patched on 17 June 2026, and no customer action is needed.

Text from CVE List

Affected versions 1

  • Application Integrationaffected: all versions before 2026-06-17CVE List

References 2