CVE-2025-13428
highpriority · track · 29EPSS 0.003 · 26 %ileDEEUUSEPSS · scored 2026-10-27
A vulnerability exists in the SecOps SOAR server. The custom integrations feature allowed an authenticated user with an "IDE role" to achieve Remote Code Execution (RCE) in the server. The flaw stemmed from weak validation of uploaded Python package code. An attacker could upload a package containing a malicious setup.py file, which would execute on the server during the installation process, leading to potential server compromise. No customer action is required. All customers have been automatically upgraded to the fixed version: 6.3.64 or higher.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.1–8.6
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
- google security operations soar< 6.3.64nvdUScpe:2.3:a:google:security_operations_soar:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-2754Google Cloud Platform: Schwachstelle ermöglicht CodeausführungDeutsch2025-12-07csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Google Cloud Platform ausnutzen, um beliebigen Programmcode auszuführen.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan