Google Cloud — Security Activity Report

Google Cloud Platform (Security Bulletins)

Generated Jul 29, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 69 CVEs with Google Cloud advisories. Source: NVD CVE records joined with vendor advisory publish dates.

02022020230202462025632026

Severity Composition

↑ +9.7 pp

62.3% of Google Cloud's 69 CVEs are CRITICAL or HIGH severity. Industry median: 52.6%. Source: NVD CVSS v3.1.

CRITICAL 6 (8.7%)HIGH 37 (53.6%)MEDIUM 23 (33.3%)NONE 1 (1.4%)

CISA KEV Listings

↑ +0.5 pp

1 of 69 Google Cloud CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (1.4%). Industry median: 1.0%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↑ +60.1 days

Median time from CVE disclosure to Google Cloud advisory: 71 days (p25 34 days – p75 99 days). Industry median: 11 days.

Sample size: 45 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across Google Cloud's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

  • CWE-416Use After Free13 CVEs
  • CWE-123Write-what-where Condition3 CVEs
  • CWE-125Out-of-bounds Read3 CVEs
  • CWE-20Improper Input Validation3 CVEs
  • CWE-362Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)3 CVEs

Recent Security Advisories

Latest advisories published by Google Cloud, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

  • GCP-2026-049High
    Jul 22, 2026

    GCP-2026-049 — Published: 2026-07-22Description Description Severity Notes A reflected Cross-Site Scripting (XSS) vulnerability was discovered in Google…

    CVE-2026-15810vendor source ↗
  • GCP-2026-048Medium
    Jul 13, 2026

    GCP-2026-048 — Published: 2026-07-13Description Description Severity Notes A privilege escalation vulnerability was addressed in Developer Connect.

    vendor source ↗
  • GCP-2026-047Critical
    Jul 13, 2026

    GCP-2026-047 — Published: 2026-07-13Description Description Severity Notes A Missing Authorization vulnerability was discovered in repositories in…

    CVE-2026-14934vendor source ↗
  • GCP-2026-045High
    Jul 7, 2026

    GCP-2026-045 — Published: 2026-06-29Description Description Severity Notes A vulnerability was detected in Envoy Proxy where blocked QPACK decoding can…

    vendor source ↗
  • GCP-2026-046
    Jul 7, 2026

    GCP-2026-046 — Published: 2026-07-06Description Description Severity Notes A virtualization vulnerability has been identified in the KVM x86 shadow paging…

    CVE-2026-53359vendor source ↗
  • GCP-2026-044High
    Jun 25, 2026

    GCP-2026-044 — Published: 2026-06-25Description Description Severity Notes A vulnerability was detected in Application Integration's JavaScript task,…

    CVE-2025-0982vendor source ↗
  • GCP-2026-043High
    Jun 24, 2026

    GCP-2026-043 — Published: 2026-06-24Description Description Severity Notes A vulnerability was found in Firebase Studio where the GetSignedGcsUrl RPC…

    CVE-2026-12715vendor source ↗
  • GCP-2026-042Low
    Jun 24, 2026

    GCP-2026-042 — Published: 2026-06-24Description Description Severity Notes A privilege escalation vulnerability was addressed in Cloud Build.

    vendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

  • NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
  • MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
  • CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
  • Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
  • MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Jul 29, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.

Spot a factual error in this report?

Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.