Google Cloud — Security Activity Report
Google Cloud Platform (Security Bulletins)
Generated Nov 13, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗
CVE Disclosure Volume
Total all-time: 125 CVEs with Google Cloud advisories. Source: NVD CVE records joined with vendor advisory publish dates.
Severity Composition
↑ +8.3 pp63.2% of Google Cloud's 125 CVEs are CRITICAL or HIGH severity. Industry median: 54.9%. Source: NVD CVSS v3.1.
CISA KEV Listings
↑ +5.0 pp7 of 125 Google Cloud CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (5.6%). Industry median: 0.6%.
Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.
Vendor Patch Velocity
↑ +59.9 daysMedian time from CVE disclosure to Google Cloud advisory: 71 days (p25 14 days – p75 99 days). Industry median: 11 days.
Sample size: 55 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.
Top Recurring Weakness Classes
Most-frequently mapped CWEs across Google Cloud's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.
Recent Security Advisories
Latest advisories published by Google Cloud, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.
- GCP-2026-081MediumNov 10, 2026
GCP-2026-081 — Published: 2026-11-10Description Description Severity Notes AMD has disclosed three vulnerabilities that affect 5th generation AMD EPYC…
- GCP-2026-080HighNov 9, 2026
GCP-2026-080 — Published: 2026-11-09Updated: 2026-11-12Description Description Severity Notes Security vulnerabilities were discovered in Istio…
- GCP-2026-079CriticalNov 5, 2026
GCP-2026-079 — Published: 2026-11-05Description Description Severity Notes Per advisory VMSA-2026-0008, Broadcom has identified an out-of-bounds write…
- GCP-2026-078MediumNov 4, 2026
GCP-2026-078 — Published: 2026-11-04Description Description Severity Notes A vulnerability (CVE-2026-98432) was discovered in the Linux kernel IPv4 TCP…
- GCP-2026-077MediumNov 3, 2026
GCP-2026-077 — Published: 2026-11-03Description Description Severity Notes Following the private-key compromise of intermediate Certificate Authorities…
- GCP-2026-075MediumNov 2, 2026
GCP-2026-075 — Published: 2026-11-02Description Description Severity Notes On Saturday, October 17, 2026, Google received a report from a security…
- GCP-2026-076MediumNov 2, 2026
GCP-2026-076 — Published: 2026-11-02Description Description Severity Notes A security vulnerability was discovered in Istio (ISTIO-SECURITY-2026-008). For…
- GCP-2026-074CriticalOct 28, 2026
GCP-2026-074 — Published: 2026-10-28Description Description Severity Notes A Deserialization of Untrusted Data vulnerability was discovered in the…
Full advisory archive: /pulse/vendor-advisories →
Data sources & corrections
- NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
- MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
- CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
- Vendor security advisories (Red Hat RHSA, Ubuntu USN, Microsoft MSRC, Cisco PSIRT and other per-vendor feeds; the GitHub and OSV advisory databases are not used) — published_at timestamps
- MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings
Snapshot generated Nov 13, 2026: when these counts and industry medians were computed. Vendors in the index are recomputed every 6 hours.
Spot a factual error in this report?
Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.