High severity · published Sep 28, 2026
CVE-2026-81375
Confused Deputy in Application Integration allows Internal File Read
8.3
CVSS
0.3%
EPSS
No
On KEV
Description
A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path.
This vulnerability was patched on 30 June 2026, and no customer action is needed.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Application Integration · Google Cloud
before 2026-06-30 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-81375
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-81375
docs.cloud.google.com
https://docs.cloud.google.com/support/bulletins#gcp-2026-066
docs.cloud.google.com
https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-066
More from Application Integration
9.4
CVE-2026-81867
Deserialization of Untrusted Data in Application Integration allows Remote Code Execution
9.4
CVE-2026-19759
Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution
9.3
CVE-2026-12710
Missing Authorization in Application Integration QueryEngineTask
7.3
CVE-2026-85298
Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation