Google Cloud — Security Activity Report

Google Cloud Platform (Security Bulletins)

Generated Jul 22, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 63 CVEs with Google Cloud advisories. Source: NVD CVE records joined with vendor advisory publish dates.

Severity Composition

↑ +8.1 pp

60.3% of Google Cloud's 63 CVEs are CRITICAL or HIGH severity. Industry median: 52.2%. Source: NVD CVSS v3.1.

CRITICAL 6 (9.5%)HIGH 32 (50.8%)MEDIUM 21 (33.3%)NONE 2 (3.2%)

CISA KEV Listings

↑ +0.6 pp

1 of 63 Google Cloud CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (1.6%). Industry median: 1.0%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↑ +60.0 days

Median time from CVE disclosure to Google Cloud advisory: 75 days (p25 24 days – p75 99 days). Industry median: 15 days.

Sample size: 40 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across Google Cloud's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

CWE-416Use After Free10 CVEs
CWE-123Write-what-where Condition3 CVEs
CWE-125Out-of-bounds Read3 CVEs
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)3 CVEs
CWE-476NULL Pointer Dereference3 CVEs

Recent Security Advisories

Latest advisories published by Google Cloud, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

GCP-2026-048Medium
Jul 13, 2026
GCP-2026-048 — Published: 2026-07-13Description Description Severity Notes A privilege escalation vulnerability was addressed in Developer Connect.
vendor source ↗
GCP-2026-047Critical
Jul 13, 2026
GCP-2026-047 — Published: 2026-07-13Description Description Severity Notes A Missing Authorization vulnerability was discovered in repositories in…
CVE-2026-14934 vendor source ↗
GCP-2026-045High
Jul 7, 2026
GCP-2026-045 — Published: 2026-06-29Description Description Severity Notes A vulnerability was detected in Envoy Proxy where blocked QPACK decoding can…
vendor source ↗
GCP-2026-046
Jul 7, 2026
GCP-2026-046 — Published: 2026-07-06Description Description Severity Notes A virtualization vulnerability has been identified in the KVM x86 shadow paging…
CVE-2026-53359 vendor source ↗
GCP-2026-044High
Jun 25, 2026
GCP-2026-044 — Published: 2026-06-25Description Description Severity Notes A vulnerability was detected in Application Integration's JavaScript task,…
CVE-2025-0982 vendor source ↗
GCP-2026-043High
Jun 24, 2026
GCP-2026-043 — Published: 2026-06-24Description Description Severity Notes A vulnerability was found in Firebase Studio where the GetSignedGcsUrl RPC…
CVE-2026-12715 vendor source ↗
GCP-2026-042Low
Jun 24, 2026
GCP-2026-042 — Published: 2026-06-24Description Description Severity Notes A privilege escalation vulnerability was addressed in Cloud Build.
vendor source ↗
GCP-2026-041High
Jun 24, 2026
GCP-2026-041 — Published: 2026-06-24Description Description Severity Notes A recent security investigation was conducted regarding log4j vulnerabilities…
CVE-2026-34480 CVE-2026-34477 vendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Jul 22, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.

Spot a factual error in this report?

Email support@echelongraph.io with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.