CVE-2026-15623: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Google Cloud Google SecOps (Chronicle SOAR)
CVE-2026-15623 is a critical SQL Injection vulnerability in a legacy dashboard widget API of Google Cloud Google SecOps (Chronicle SOAR) versions prior to 6.3.85. It allows an authenticated attacker to execute blind SQL queries by crafting a malicious request parameter. This vulnerability has been patched in version 6.3.85, and no customer action is required as the vendor manages remediation for this cloud service.
AI Analysis
Technical Summary
This vulnerability involves improper neutralization of special elements in SQL commands (CWE-89) within a legacy dashboard widget API of Google Cloud Google SecOps (Chronicle SOAR). Authenticated attackers can exploit this flaw to perform blind SQL injection attacks by sending specially crafted request parameters. The issue affects versions prior to 6.3.85 and has been addressed by Google in that version. Since this is a cloud-hosted service, Google manages the remediation server-side.
Potential Impact
An authenticated attacker could exploit this vulnerability to execute blind SQL queries against the backend database, potentially leading to unauthorized data access or manipulation. The CVSS 4.0 score of 9.4 indicates a critical severity with high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported.
Mitigation Recommendations
The vulnerability has been patched in version 6.3.85. As this is a cloud service, Google manages the remediation on the server side, and no customer action is needed. Users should verify that their service is running the patched version or that the vendor has applied the fix.
CVE-2026-15623: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Google Cloud Google SecOps (Chronicle SOAR)
Description
CVE-2026-15623 is a critical SQL Injection vulnerability in a legacy dashboard widget API of Google Cloud Google SecOps (Chronicle SOAR) versions prior to 6.3.85. It allows an authenticated attacker to execute blind SQL queries by crafting a malicious request parameter. This vulnerability has been patched in version 6.3.85, and no customer action is required as the vendor manages remediation for this cloud service.
CVSS v4.0
Score 9.4critical
Affected software
pkg:github/google/chronicle-soarRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves improper neutralization of special elements in SQL commands (CWE-89) within a legacy dashboard widget API of Google Cloud Google SecOps (Chronicle SOAR). Authenticated attackers can exploit this flaw to perform blind SQL injection attacks by sending specially crafted request parameters. The issue affects versions prior to 6.3.85 and has been addressed by Google in that version. Since this is a cloud-hosted service, Google manages the remediation server-side.
Potential Impact
An authenticated attacker could exploit this vulnerability to execute blind SQL queries against the backend database, potentially leading to unauthorized data access or manipulation. The CVSS 4.0 score of 9.4 indicates a critical severity with high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported.
Mitigation Recommendations
The vulnerability has been patched in version 6.3.85. As this is a cloud service, Google manages the remediation on the server side, and no customer action is needed. Users should verify that their service is running the patched version or that the vendor has applied the fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GoogleCloud
- Date Reserved
- 2026-07-13T17:22:36.577Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 6a82ad23bf8831d53966a7f5
Added to database: 08/17/2026, 06:41:39 UTC
Last enriched: 08/17/2026, 06:56:06 UTC
Last updated: 08/17/2026, 08:17:08 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.