{"affected":[{"defaultStatus":"unaffected","product":"Compute Engine","source":"CNA: GoogleCloud","vendor":"Google Cloud","versions":[{"lessThan":"2026-08-31","status":"affected","version":"0","versionType":"date"}]}],"cveId":"CVE-2026-85299","cwes":["CWE-862"],"description":"A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data.\n\n\nThis vulnerability was patched on 31 August 2026, and no customer action is needed.","epss":{"date":"2026-11-04","percentile":0.17245,"score":0.00255},"exploits":[],"kev":null,"metrics":[{"score":8.3,"severity":"high","source":"CNA: GoogleCloud","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/U:Clear","version":"4.0"}],"modifiedAt":1793804322855,"publishedAt":1793091752461,"references":[{"source":"CNA: GoogleCloud","tags":[],"url":"https://docs.cloud.google.com/compute/docs/security-bulletins#gcp-2026-073"}],"remediation":[],"revision":"3d8cf01a3b18a89b6b9e06558b7a0081d3a91e35b5594c0f3c7c45af88cd8c55","sources":[{"modifiedAt":1793804322855,"name":"CNA: GoogleCloud","retrievedAt":1793805072217,"url":"https://www.cve.org/CVERecord?id=CVE-2026-85299"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793805080457,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85299"}],"ssvc":{"assessedAt":1793803872618,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration","updatedAt":1793805080457}