CVE-2025-9918: Google Cloud Google Secops Soar

High severity, CVSS 8.7. EPSS: 0.6% chance of exploitation in the next 30 days.

A Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server (versions 6.3.54.0, 6.3.53.2, and all prior versions) allows an authenticated attacker with permissions to import Use Cases to achieve Remote Code Execution (RCE) via uploading a malicious ZIP archive containing path traversal sequences.

Affected products

• Google Cloud Google Secops Soar: before 6.3.54.0 (fixed in 6.3.54.0); before 6.3.53.2 (fixed in 6.3.53.2)

Published 2025-09-11. Last modified 2026-06-17.