CVE-2026-86708

Summary

The flaw allows unauthenticated attackers to access a Google Cloud service-account private key in the Applications Manager installer, enabling them to impersonate the service account and potentially access or modify cloud resources.

Exploitability

Exploitation is relatively easy given the unauthenticated nature and the presence of a private key in the installer. An attacker would need access to the installer file.

Blast radius

If exploited, the impact could be significant, as it allows unauthorized access to cloud resources associated with the service account.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the Applications Manager installer feature until a patch is available or upgrade to the latest version of the Applications Manager.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.