Vulnerabilities & Exploits
Google patched Application Integration service-account impersonation flaw Google’s October 19, 2026 security bulletin disclosed an authorization flaw in Application Integration that let authenticated users impersonate a service account. Google says it patched the flaw on August 27, before publishing the bulletin.
The issue affected AuthConfig validation and the integration execution runtime. An authenticated user could escalate privileges and act as a service account in the Google Cloud project, potentially gaining that identity’s project permissions.
For customers using Application Integration, this is a provider-side fix rather than a tenant patch: Google says no customer action is required. The bulletin does not indicate that customer environments remain exposed.
1 source · 17h ago
CVEs in this update
379 CVEs
Across react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel, and related packages.
20 critical · 183 high · 118 medium · 9 low
24 in CISA KEV · 129 with EPSS above 1%
25 with functional or packaged public exploit code
Highest severity: CVE-2025-55182 · 10.0 CRITICAL
Highest EPSS: CVE-2021-22005 · 100%
Showing the top 10 by KEV, EPSS, and severity.
Timeline Oct 23 Reported by Google Cloud Security Bulletins Dec 12 CISA federal deadline for CVE-2025-55182 passedDec 5 CVE-2025-55182 added to CISA KEVOct 27 CISA federal deadline for CVE-2025-61882 passedOct 6 CVE-2025-61882 added to CISA KEVFeb 12 CISA federal deadline for CVE-2023-34048 passedJan 22 CVE-2023-34048 added to CISA KEVOct 31 CISA federal deadline for CVE-2023-44487 passedOct 10 CVE-2023-44487 added to CISA KEVOct 4 CISA federal deadline for CVE-2023-4863 passedSep 13 CVE-2023-4863 added to CISA KEVMay 3 CISA federal deadline for CVE-2021-34527 passedApr 27 CISA federal deadline for CVE-2021-3156 passedApr 6 CVE-2021-3156 added to CISA KEVNov 17 CISA federal deadline for CVE-2021-22005 passedNov 3 CVE-2021-22005 added to CISA KEVSources Oct 23 Google Cloud Security Bulletins
Security bulletins | Cloud Customer Care | Google Cloud Documentation
The following security bulletins are related to Google Cloud products.
original Oct 23 Google Cloud Security Bulletins
Security bulletins | Cloud Customer Care | Google Cloud Documentation
original Oct 23 Google Cloud Security Bulletins
Security bulletins | Cloud Customer Care | Google Cloud Documentation
original Part of the PlainSec briefing for 2026-10-24
Every edition of this story: Google patched Application Integration service-account impersonation flaw
More from today Vulnerabilities & Exploits
Google patched Application Integration service-account impersonation flaw Google’s October 19, 2026 security bulletin disclosed an authorization flaw in Application Integration that let authenticated users impersonate a service account. Google says it patched the flaw on August 27, before publishing the bulletin.
The issue affected AuthConfig validation and the integration execution runtime. An authenticated user could escalate privileges and act as a service account in the Google Cloud project, potentially gaining that identity’s project permissions.
For customers using Application Integration, this is a provider-side fix rather than a tenant patch: Google says no customer action is required. The bulletin does not indicate that customer environments remain exposed.
1 source · 17h ago
CVEs in this update
379 CVEs
Across react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel, and related packages.
20 critical · 183 high · 118 medium · 9 low
24 in CISA KEV · 129 with EPSS above 1%
25 with functional or packaged public exploit code
Highest severity: CVE-2025-55182 · 10.0 CRITICAL
Highest EPSS: CVE-2021-22005 · 100%
Showing the top 10 by KEV, EPSS, and severity.
Timeline Oct 23 Reported by Google Cloud Security Bulletins Dec 12 CISA federal deadline for CVE-2025-55182 passedDec 5 CVE-2025-55182 added to CISA KEVOct 27 CISA federal deadline for CVE-2025-61882 passedOct 6 CVE-2025-61882 added to CISA KEVFeb 12 CISA federal deadline for CVE-2023-34048 passedJan 22 CVE-2023-34048 added to CISA KEVOct 31 CISA federal deadline for CVE-2023-44487 passedOct 10 CVE-2023-44487 added to CISA KEVOct 4 CISA federal deadline for CVE-2023-4863 passedSep 13 CVE-2023-4863 added to CISA KEVMay 3 CISA federal deadline for CVE-2021-34527 passedApr 27 CISA federal deadline for CVE-2021-3156 passedApr 6 CVE-2021-3156 added to CISA KEVNov 17 CISA federal deadline for CVE-2021-22005 passedNov 3 CVE-2021-22005 added to CISA KEVSources Oct 23 Google Cloud Security Bulletins
Security bulletins | Cloud Customer Care | Google Cloud Documentation
The following security bulletins are related to Google Cloud products.
original Oct 23 Google Cloud Security Bulletins
Security bulletins | Cloud Customer Care | Google Cloud Documentation
original Oct 23 Google Cloud Security Bulletins
Security bulletins | Cloud Customer Care | Google Cloud Documentation
original Part of the PlainSec briefing for 2026-10-24
Every edition of this story: Google patched Application Integration service-account impersonation flaw
More from today