Critical severity · published Aug 26, 2026
CVE-2026-19485
Bucket Squatting in Vertex AI Search for Commerce
9.3
CVSS
0.4%
EPSS
No
On KEV
Description
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictable bucket names.
This vulnerability was patched and no customer action is needed.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
Vertex AI Search for Commerce · Google Cloud
before 2026-04-27 · source: vendor