CVE-2025-9571 describes a critical Remote Code Execution (RCE) vulnerability in Google Cloud Data Fusion, specifically impacting its core AppFabric component. An authenticated attacker with artifact upload permissions can leverage this to execute arbitrary code, potentially gaining full control over the Data Fusion instance, accessing sensitive data, and manipulating data pipelines. With a CVSS score of 8.7 (HIGH), this vulnerability presents a significant risk due to its low attack complexity and high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code, and community discussion is minimal, immediate upgrades to CDAP versions 6.10.6+ or 6.11.1+ are strongly recommended to mitigate this threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Google Cloud | Cloud Data Fusion | >= 0, < 6.10.6, >= 0, < 6.11.1CNA affecteddefault unaffected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.