Vulnerability · Published Oct 27, 2026 · Assigned by GoogleCloud

CVE-2026-85299Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration

High 8.3

In plain English

A high-severity missing authorization in Compute Engine from Google Cloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 4.0)8.3High

Exploit odds (30 days)0.3%top 82.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data. This vulnerability was patched on 31 August 2026, and no customer action is needed.

Affected products (as reported)

Vendor	Product	Versions
Google Cloud	Compute Engine	0 – before 2026-08-31

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/U:Clear

References

https://docs.cloud.google.com/compute/docs/security-bulletins#gcp-2026-073