All vulnerabilities
CVE-2026-81375

Confused Deputy in Application Integration allows Internal File Read

Google Cloud Application Integration
Open in ThreatlineRecord JSON
CVSS
8.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2026-06-30Fixed versionCVE List
Published28 Sep 2026Updated 28 Sep 2026CVE List

What fixes it

  • 2026-06-30Application IntegrationCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path.

This vulnerability was patched on 30 June 2026, and no customer action is needed.

Text from CVE List

Affected versions 1

  • Application Integrationaffected: all versions before 2026-06-30CVE List

References 2