{"id":"CVE-2026-85299","published":"2026-10-27T10:16:56.500","lastModified":"2026-10-27T15:08:50.630","description":"A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data.\n\n\nThis vulnerability was patched on 31 August 2026, and no customer action is needed.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://docs.cloud.google.com/compute/docs/security-bulletins#gcp-2026-073","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}