Google Cloud has disclosed and fixed a SQL injection vulnerability in its SecOps security platform. Tracked as EUVD-2026-60060 and CVE-2026-15623, the flaw carries a CVSS score of 9.4 and sits in a dashboard widget API. It lets authenticated attackers execute their own SQL queries.
Insufficient input validation as the cause
The vulnerability stems from insufficient input validation in the API for dashboard components. An authenticated attacker can use specially crafted request parameters to execute SQL queries. In this kind of blind SQL injection, the attacker doesn't get the query results directly, but infers the data from the system's response, for example through timing analysis or differences in how the application responds. That allows step-by-step access to sensitive database content.
Patched automatically, no customer action needed
All versions of Google SecOps before 6.3.85 are considered vulnerable. Google closed the flaw back in May with version 6.3.85, released on May 23, 2026. Since this is a cloud service, the fix was rolled out automatically, and you don't need to take any action as a customer. Even so, it's worth looking back: check your audit logs for suspicious SQL query patterns in the dashboard widget API to spot any possible exploitation attempts that occurred before the patch was installed.