8.3
HighCVSS 4.0 · from GoogleCloud
CVE-2026-85299
Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration
Compute Engine · Missing authorization · CWE-862AffectedCompute Engine
FixUpdate to 2026-08-31 or newer
PublishedOct 27, 09:02 · GoogleCloud
ScoredOct 27 · 8.3 · GoogleCloud
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can read data. CVSS impact.
Description
A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data. This vulnerability was patched on 31 August 2026, and no customer action is needed.
From GoogleCloud
Affected and fixed versions
ProductAffectedFixed inCompute Enginebefore 2026-08-312026-08-31
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known