CVE-2026-15623
CriticalCVSS 9.4Summary
A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. This vulnerability was patched in version 6.3.85, and no customer action is needed.
Risk Assessment
The risk is that an attacker can gain unauthorized access to or manipulate data in the database, potentially leading to data confidentiality and integrity breaches.
Recommendation
It is recommended to ensure the system is updated to version 6.3.85 or later, which includes the fix.
Original NVD description (English source)
A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. This vulnerability was patched in version 6.3.85, and no customer action is needed.