by Kastro
Paper/Archive/CVE-2026-12710

CVE-2026-12710

Google Cloud Application Integration — Missing Authorization in Application Integration QueryEngineTask

EPSS 0.4%CVSS 9.3
critical.is priorityof 100
35
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 34.8.348 × 207.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration (versions from 2025-04-28 to 2026-04-04) allows an external attacker to access sensitive internal data. The issue was patched on April 4, 2026; no customer action is required.

Affected

ProductAffectedFixed inSource
Application Integration2025-04-28 – < 2026-04-042026-04-04CNA

Scores by source

GoogleCloud (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Clear
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcloud.google.com/application-integration/docs/release-notes#August_21_2026