Vulnerability · Published Aug 26, 2026 · Assigned by GoogleCloud
CVE-2026-19485Bucket Squatting in Vertex AI Search for Commerce
Critical 9.3
In plain English
A critical-severity weak randomness in Vertex AI Search for Commerce from Google Cloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Official description
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictable bucket names. This vulnerability was patched and no customer action is needed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google Cloud | Vertex AI Search for Commerce | 0 – before 2026-04-27 |
Weakness: CWE-330 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/U:Clear