Vulnerability · Published Sep 28, 2026 · Assigned by GoogleCloud

CVE-2026-81375Confused Deputy in Application Integration allows Internal File Read

High 8.3

In plain English

A high-severity security flaw in Application Integration from Google Cloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 4.0)8.3High

Exploit odds (30 days)0.3%top 75.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability was patched on 30 June 2026, and no customer action is needed.

Affected products (as reported)

Vendor	Product	Versions
Google Cloud	Application Integration	0 – before 2026-06-30

Weakness: CWE-610 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/U:Clear

In plain English

Official description

Affected products (as reported)

References