# CVE-2026-19759

Authz flaw in Google Cloud Application Integration allows privileged internal RPC execution

- Page: https://www.vulneraibility.com/cve/CVE-2026-19759
- CVSS: 9.4
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.24% (percentile 14.6)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-09-28)
- Weakness: CWE-863
- Published: 2026-09-28

## Affected versions

- Google Cloud Application Integration: affected < 2026-06-17

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated GCP user can invoke internal RPCs as a privileged identity, enabling privilege escalation and lateral access inside Google's production network.

## Action

Monitor only

## Recommendation

Confirm services are updated to 2026-06-17 patch and audit authenticated activity.

## References

- [other] https://docs.cloud.google.com/support/bulletins#gcp-2026-064
- [other] https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-064

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.