CVE-2026-15587: CWE-346 Origin Validation Error in Google Cloud Google SecOps (Chronicle SOAR)
CVE-2026-15587 is a critical vulnerability in Google SecOps (Chronicle SOAR) on Google Cloud Platform that allows an authenticated attacker to escalate privileges to system-level administrative access by exploiting improper privilege management via a crafted internal authentication header. This issue affects versions prior to 6.3.85. The vulnerability has been patched in version 6.3.85, and no customer action is required as the vendor manages remediation for this cloud service.
AI Analysis
Technical Summary
This vulnerability, identified as CWE-346 (Origin Validation Error), exists in Google SecOps (Chronicle SOAR) versions before 6.3.85 on Google Cloud Platform. It allows an authenticated attacker to escalate privileges to system-level administrative access by crafting an internal authentication header improperly validated by the system. The vulnerability has a CVSS 4.0 score of 9.4, indicating critical severity. Since this is a cloud-hosted service, Google Cloud manages the patching process, and the fix was introduced in version 6.3.85.
Potential Impact
An authenticated attacker can escalate their privileges to system-level administrative access, potentially gaining full control over the affected Google SecOps (Chronicle SOAR) environment. This could lead to unauthorized actions at the highest privilege level within the system.
Mitigation Recommendations
The vulnerability has been patched in Google SecOps (Chronicle SOAR) version 6.3.85. As this is a cloud service, Google Cloud manages the remediation server-side, and no customer action is required. Customers should verify they are using version 6.3.85 or later and consult the vendor advisory for confirmation.
CVE-2026-15587: CWE-346 Origin Validation Error in Google Cloud Google SecOps (Chronicle SOAR)
Description
CVE-2026-15587 is a critical vulnerability in Google SecOps (Chronicle SOAR) on Google Cloud Platform that allows an authenticated attacker to escalate privileges to system-level administrative access by exploiting improper privilege management via a crafted internal authentication header. This issue affects versions prior to 6.3.85. The vulnerability has been patched in version 6.3.85, and no customer action is required as the vendor manages remediation for this cloud service.
CVSS v4.0
Score 9.4critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability, identified as CWE-346 (Origin Validation Error), exists in Google SecOps (Chronicle SOAR) versions before 6.3.85 on Google Cloud Platform. It allows an authenticated attacker to escalate privileges to system-level administrative access by crafting an internal authentication header improperly validated by the system. The vulnerability has a CVSS 4.0 score of 9.4, indicating critical severity. Since this is a cloud-hosted service, Google Cloud manages the patching process, and the fix was introduced in version 6.3.85.
Potential Impact
An authenticated attacker can escalate their privileges to system-level administrative access, potentially gaining full control over the affected Google SecOps (Chronicle SOAR) environment. This could lead to unauthorized actions at the highest privilege level within the system.
Mitigation Recommendations
The vulnerability has been patched in Google SecOps (Chronicle SOAR) version 6.3.85. As this is a cloud service, Google Cloud manages the remediation server-side, and no customer action is required. Customers should verify they are using version 6.3.85 or later and consult the vendor advisory for confirmation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GoogleCloud
- Date Reserved
- 2026-07-13T12:21:09.118Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 6a7360c9bf8831d539228d76
Added to database: 08/05/2026, 16:11:53 UTC
Last enriched: 08/05/2026, 16:26:30 UTC
Last updated: 08/05/2026, 17:17:52 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.