High severity · published Oct 14, 2026
CVE-2026-85298
Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation
7.3
CVSS
0.4%
EPSS
No
On KEV
Description
An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project.
This vulnerability was patched on 27 August 2026, and no customer action is needed.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Application Integration · Google Cloud
before 2026-08-27 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85298
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85298
docs.cloud.google.com
https://docs.cloud.google.com/support/bulletins#gcp-2026-068
docs.cloud.google.com
https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-068
More from Application Integration
9.4
CVE-2026-81867
Deserialization of Untrusted Data in Application Integration allows Remote Code Execution
9.4
CVE-2026-19759
Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution
9.3
CVE-2026-12710
Missing Authorization in Application Integration QueryEngineTask
8.3
CVE-2026-81375
Confused Deputy in Application Integration allows Internal File Read