Google Cloud — Security Activity Report

Google Cloud Platform (Security Bulletins)

Generated Aug 20, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 85 CVEs with Google Cloud advisories. Source: NVD CVE records joined with vendor advisory publish dates.

02022020230202462025792026

Severity Composition

↑ +10.0 pp

63.5% of Google Cloud's 85 CVEs are CRITICAL or HIGH severity. Industry median: 53.6%. Source: NVD CVSS v3.1.

CRITICAL 9 (10.6%)HIGH 45 (52.9%)MEDIUM 30 (35.3%)LOW 1 (1.2%)

CISA KEV Listings

↑ +1.4 pp

2 of 85 Google Cloud CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (2.4%). Industry median: 0.9%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↑ +63.8 days

Median time from CVE disclosure to Google Cloud advisory: 71 days (p25 20 days – p75 99 days). Industry median: 7 days.

Sample size: 47 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across Google Cloud's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

Recent Security Advisories

Latest advisories published by Google Cloud, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

  • NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
  • MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
  • CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
  • Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
  • MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Aug 20, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.

Spot a factual error in this report?

Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.