Google Cloud — Security Activity Report
Google Cloud Platform (Security Bulletins)
Generated Oct 4, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗
CVE Disclosure Volume
Total all-time: 104 CVEs with Google Cloud advisories. Source: NVD CVE records joined with vendor advisory publish dates.
Severity Composition
↑ +12.2 pp65.4% of Google Cloud's 104 CVEs are CRITICAL or HIGH severity. Industry median: 53.2%. Source: NVD CVSS v3.1.
CISA KEV Listings
↑ +1.2 pp2 of 104 Google Cloud CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (1.9%). Industry median: 0.8%.
Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.
Vendor Patch Velocity
↑ +46.5 daysMedian time from CVE disclosure to Google Cloud advisory: 71 days (p25 24 days – p75 99 days). Industry median: 24 days.
Sample size: 48 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.
Top Recurring Weakness Classes
Most-frequently mapped CWEs across Google Cloud's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.
Recent Security Advisories
Latest advisories published by Google Cloud, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.
- GCP-2026-066HighSep 28, 2026
GCP-2026-066 — Published: 2026-09-28Description Description Severity Notes A Confused Deputy vulnerability was discovered in the Email Task component in…
- GCP-2026-065CriticalSep 28, 2026
GCP-2026-065 — Published: 2026-09-28Description Description Severity Notes A Deserialization of Untrusted Data vulnerability was discovered in the…
- GCP-2026-064CriticalSep 28, 2026
GCP-2026-064 — Published: 2026-09-28Description Description Severity Notes An Incorrect Authorization vulnerability was discovered in the…
- GCP-2026-063CriticalSep 16, 2026
GCP-2026-063 — Published: 2026-09-16Description Description Severity Notes An Improper Privilege Management vulnerability in Google Security Operations…
- GCP-2026-062HighSep 11, 2026
GCP-2026-062 — Published: 2026-09-11Description Description Severity Notes Multiple security vulnerabilities were discovered in Slurm that affect Cluster…
- GCP-2026-061MediumSep 9, 2026
GCP-2026-061 — Published: 2026-09-09Description Description Severity Notes A security vulnerability (GHSA-p7v4-vr35-mj6f, CVE assignment pending) in…
- GCP-2026-060HighSep 4, 2026
GCP-2026-060 — Published: 2026-09-04Updated: 2026-09-08Description Description Severity Notes 2026-09-08 Update: Added link to the Cluster Toolkit…
- GCP-2026-059HighSep 4, 2026
GCP-2026-059 — Published: 2026-09-04Description Description Severity Notes A Missing Authorization vulnerability was discovered in the HTTP Connector in…
Full advisory archive: /pulse/vendor-advisories →
Data sources & corrections
- NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
- MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
- CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
- Vendor security advisories (Red Hat RHSA, Ubuntu USN, Microsoft MSRC, Cisco PSIRT and other per-vendor feeds; the GitHub and OSV advisory databases are not used) — published_at timestamps
- MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings
Snapshot generated Oct 4, 2026: when these counts and industry medians were computed. Vendors in the index are recomputed every 6 hours.
Spot a factual error in this report?
Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.