CVE-2026-81375

Severity not reported

Data quality: awaiting analysis. NVD has not completed analysis, so CVSS and affected-product data may be missing or change.

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows…

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability was patched on 30 June 2026, and no customer action is needed.

CVSS

—

Awaiting analysis by NVD

Timeline (UTC)

Published: 2026-09-28 11:16

Modified: 2026-09-29 21:36

NVD status: Awaiting Analysis

Last synced 2 days ago

Verified against the source API 2026-10-27 06:56 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

Not reported by the source (unknown — not "none").

Weakness classification (CWE)

CWE-610

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

No vendor advisory or patch reference tagged by NVD. Check the references below.

References

https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-066 f45cbf4e-4146-4068-b7e1-655ffc2c548c
https://docs.cloud.google.com/support/bulletins#gcp-2026-066 f45cbf4e-4146-4068-b7e1-655ffc2c548c

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:56 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores