CVE-2026-2264: Google Cloud Apigee-X

Critical severity, CVSS 9.2. EPSS: 0.4% chance of exploitation in the next 30 days.

A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account access tokens. For successful exploitation, an administrator must initially establish an insecure configuration of the API proxy.

Affected products

• Google Cloud Apigee-X: before 1.14.4 (fixed in 1.14.4); before 1.15.2 (fixed in 1.15.2); before 1.16.1 (fixed in 1.16.1)

Published 2026-05-26. Last modified 2026-07-24.