Google Cloud — Security Activity Report

Google Cloud Platform (Security Bulletins)

Generated Sep 19, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 87 CVEs with Google Cloud advisories. Source: NVD CVE records joined with vendor advisory publish dates.

Severity Composition

↑ +11.3 pp

64.4% of Google Cloud's 87 CVEs are CRITICAL or HIGH severity. Industry median: 53.1%. Source: NVD CVSS v3.1.

CRITICAL 10 (11.5%)HIGH 46 (52.9%)MEDIUM 30 (34.5%)LOW 1 (1.1%)

CISA KEV Listings

↑ +1.5 pp

2 of 87 Google Cloud CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (2.3%). Industry median: 0.8%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↑ +62.2 days

Median time from CVE disclosure to Google Cloud advisory: 71 days (p25 20 days – p75 99 days). Industry median: 9 days.

Sample size: 47 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across Google Cloud's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

CWE-416Use After Free13 CVEs
CWE-125Out-of-bounds Read4 CVEs
CWE-20Improper Input Validation4 CVEs
CWE-787Out-of-bounds Write4 CVEs
CWE-863Incorrect Authorization4 CVEs

Recent Security Advisories

Latest advisories published by Google Cloud, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

GCP-2026-062High
Sep 11, 2026
GCP-2026-062 — Published: 2026-09-11Description Description Severity Notes Multiple security vulnerabilities were discovered in Slurm that affect Cluster…
CVE-2026-65108 CVE-2026-65138 CVE-2026-65139 CVE-2026-65168 CVE-2026-65107 CVE-2026-65109+2 more CVEsvendor source ↗
GCP-2026-061Medium
Sep 9, 2026
GCP-2026-061 — Published: 2026-09-09Description Description Severity Notes A security vulnerability (GHSA-p7v4-vr35-mj6f, CVE assignment pending) in…
vendor source ↗
GCP-2026-060High
Sep 4, 2026
GCP-2026-060 — Published: 2026-09-04Updated: 2026-09-08Description Description Severity Notes 2026-09-08 Update: Added link to the Cluster Toolkit…
CVE-2026-65107 vendor source ↗
GCP-2026-059High
Sep 4, 2026
GCP-2026-059 — Published: 2026-09-04Description Description Severity Notes A Missing Authorization vulnerability was discovered in the HTTP Connector in…
CVE-2026-4644 vendor source ↗
GCP-2026-058Critical
Sep 2, 2026
GCP-2026-058 — Published: 2026-09-02Description Description Severity Notes A missing project permission check in GKE Multi-Cloud (CreateAttachedCluster,…
vendor source ↗
GCP-2026-057
Aug 26, 2026
GCP-2026-057 — Published: 2026-08-26Description Description Severity Notes A series of vulnerabilities were discovered in Envoy Proxy. For instructions…
CVE-2026-50572 CVE-2026-73511 CVE-2026-73550 CVE-2026-73552 CVE-2026-73547 CVE-2026-73549+7 more CVEsvendor source ↗
GCP-2026-056Critical
Aug 26, 2026
GCP-2026-056 — Published: 2026-08-26Description Description Severity Notes An Improper Input Validation vulnerability was discovered in the JDBC driver in…
CVE-2026-12717 vendor source ↗
GCP-2026-055High
Aug 25, 2026
GCP-2026-055 — Published: 2026-08-25Description Description Severity Notes A critical unauthenticated Remote Code Execution (RCE) vulnerability exists in…
vendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Sep 19, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.

Spot a factual error in this report?

Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.