Critical severity · published Sep 28, 2026
CVE-2026-19759
Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution
9.4
CVSS
0.2%
EPSS
No
On KEV
Description
An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside Google's production network under a privileged identity using an internal-only task type.
This vulnerability was patched on 17 June 2026, and no customer action is needed.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Application Integration · Google Cloud
before 2026-06-17 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19759
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19759
docs.cloud.google.com
https://docs.cloud.google.com/support/bulletins#gcp-2026-064
docs.cloud.google.com
https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-064
More from Application Integration
9.4
CVE-2026-81867
Deserialization of Untrusted Data in Application Integration allows Remote Code Execution
9.3
CVE-2026-12710
Missing Authorization in Application Integration QueryEngineTask
8.3
CVE-2026-81375
Confused Deputy in Application Integration allows Internal File Read
7.3
CVE-2026-85298
Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation