SEPTEMBER 14, 2026
Live Feed
Back to database
Case File

CVE-2026-19486

HIGH · CVSS 8.7 EPSS 0.25%

Source: NVD + CISA KEV + EPSS · Published 2026-09-11 · Last synced 2026-09-14

CyberRota Analysis

AI-Generated

A Server-Side Request Forgery (SSRF) vulnerability in the Google Cloud Gemini Enterprise Agent Platform App Builder prior to June 1, 2026, allows unauthenticated attackers to leak the Compute Engine default service account access token. This could lead to unauthorized access to sensitive resources within the Google Cloud environment. Organizations utilizing affected versions should prioritize patching and redeploying their applications to mitigate potential exploitation.

CVE
CVE-2026-19486
Severity
HIGH
CVSS
8.7
EPSS
0.25%

Original NVD Description

A Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on 01 June 2026. Users will need to redeploy their previously deployed apps.