CVE-2026-15587CWE-346

CVE-2026-15587

published August 5, 2026

CVSS
9.4
EPSS
0%
Percentile
13.0
In the wild
Unconfirmed
What it is

Improper Privilege Management in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to escalate privileges to system-level administrative access using a crafted internal authentication header.

This vulnerability was patched with version 6.3.85, and no customer action is needed.

The record
Technical detail
CVSS
9.4 · NONE
CVSS v4.0
Not supplied
EPSS
0.00229 · 13.0th percentile
Weakness
CWE-346 · Origin Validation Error
Published
2026-08-05T20:16Z
References (1)
https://docs.cloud.google.com/chronicle/docs/soar/release-notes#May_23_2026 · f45cbf4e-4146-4068-b7e1-655ffc2c548c
EPSS history
Timeline
  • 05 AUG 14:40Z
    Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication Header
    cvelistv5