Google Cloud — Security Activity Report
Google Cloud Platform (Security Bulletins)
Generated Nov 2, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗
CVE Disclosure Volume
Total all-time: 110 CVEs with Google Cloud advisories. Source: NVD CVE records joined with vendor advisory publish dates.
Severity Composition
↑ +12.5 pp66.4% of Google Cloud's 110 CVEs are CRITICAL or HIGH severity. Industry median: 53.8%. Source: NVD CVSS v3.1.
CISA KEV Listings
↑ +4.8 pp6 of 110 Google Cloud CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (5.5%). Industry median: 0.6%.
Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.
Vendor Patch Velocity
↑ +59.6 daysMedian time from CVE disclosure to Google Cloud advisory: 71 days (p25 12 days – p75 99 days). Industry median: 11 days.
Sample size: 49 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.
Top Recurring Weakness Classes
Most-frequently mapped CWEs across Google Cloud's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.
Recent Security Advisories
Latest advisories published by Google Cloud, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.
- GCP-2026-074CriticalOct 28, 2026
GCP-2026-074 — Published: 2026-10-28Description Description Severity Notes A Deserialization of Untrusted Data vulnerability was discovered in the…
- GCP-2026-073HighOct 26, 2026
GCP-2026-073 — Published: 2026-10-26Description Description Severity Notes An incorrect authorization vulnerability was discovered in Compute Engine prior…
- GCP-2026-072CriticalOct 24, 2026
GCP-2026-072 — Published: 2026-10-24Description Description Severity Notes Two vulnerabilities in PHP core, CVE-2026-109618 and…
- GCP-2026-071MediumOct 23, 2026
GCP-2026-071 — Published: 2026-10-23Updated: 2026-10-27Description Description Severity Notes On Saturday, October 17, 2026, Google received a report from…
- GCP-2026-070CriticalOct 21, 2026
GCP-2026-070 — Published: 2026-10-21Description Description Severity Notes Two remote code execution vulnerabilities were found in the open-source PHP…
- GCP-2026-069Oct 19, 2026
GCP-2026-069 — Published: 2026-10-19Description Description Severity Notes Security vulnerabilities were discovered in Istio and Envoy Proxy…
- GCP-2026-068HighOct 14, 2026
GCP-2026-068 — Published: 2026-10-14Updated: 2026-10-24Description Description Severity Notes An Incorrect Authorization vulnerability in the…
- GCP-2026-067HighOct 12, 2026
GCP-2026-067 — Published: 2026-10-12Description Description Severity Notes A Denial-of-Service (DoS) vulnerability was discovered in Envoy Proxy when an…
Full advisory archive: /pulse/vendor-advisories →
Data sources & corrections
- NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
- MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
- CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
- Vendor security advisories (Red Hat RHSA, Ubuntu USN, Microsoft MSRC, Cisco PSIRT and other per-vendor feeds; the GitHub and OSV advisory databases are not used) — published_at timestamps
- MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings
Snapshot generated Nov 2, 2026: when these counts and industry medians were computed. Vendors in the index are recomputed every 6 hours.
Spot a factual error in this report?
Email support@echelongraph.io with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.