High severity · published Oct 27, 2026
CVE-2026-85299
Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration
New
8.3
CVSS
0.4%
EPSS
No
On KEV
Description
A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data.
This vulnerability was patched on 31 August 2026, and no customer action is needed.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Compute Engine · Google Cloud
before 2026-08-31 · source: vendor