CVE-2026-85299

Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration

Google Cloud Compute Engine

Open in Threatline Record JSON

CVSS

8.3High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed in2026-08-31Fixed versionCVE List

Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

2026-08-31Compute EngineCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

@gcpweekly.bsky.social: Compute Engine update on October 26, 2026 https://docs.cloud.google.com/compute/docs/release-notes#October_26_2026 #googlecloud A vulnerability (CVE-2026-85299) about incorrect autBluesky: CVE posts, 26 Oct 2026

Description

A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data.

This vulnerability was patched on 31 August 2026, and no customer action is needed.

Text from CVE List

Affected versions 1

Compute Engineaffected: all versions before 2026-08-31CVE List

References 1

docs.cloud.google.com/compute/docs/security-bulletins#gcp-2026-073Advisoryvia CVE List