Critical severity · published May 15, 2026
CVE-2026-2031
Google Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution.
10.0
CVSS
0.5%
EPSS
No
On KEV
Description
An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to 2026-01-23 allows a remote, unauthenticated attacker to disclose sensitive internal information and execute arbitrary code using specially crafted HTTP requests to inadvertently exposed internal API endpoints.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
II
Internal Integration Platform APIs · Google Cloud
before 2026-01-23 · source: vendor
Affected product
II
Internal Integration Platform APIs
Google Cloud