Google Cloud Discloses Fixed Compute Engine Authorization Flaw
Tech GuruQuick Answer
Google Cloud bulletin GCP-2026-073 says CVE-2026-85299 was patched on August 31 and requires no customer action. Organizations should confirm relevant Compute Engine use, assess whether historical disk-data risk warrants review, and retain the decision evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Identify projects, Compute Engine resources, disks, sensitive data, IAM boundaries, owners, and workloads present before August 31, 2026. Distinguish the managed-service authorization flaw from customer IAM misconfiguration; do not infer that disk data was accessed merely because Compute Engine was used. Do not invent a customer patch: Google states that the service was patched and no customer action is required. Confirm current service status, document applicability, review Cloud Audit Logs and incident evidence only where risk and retention justify it, and retain the bulletin and assessment.
Last verified: 2026-10-27 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Google Cloud Compute Engine |
|---|---|
| Advisory | GCP-2026-073 |
| CVE | CVE-2026-85299 |
| Authoritative release date | 2026-10-26 21:05:28.461915 UTC |
| Authority revision date | 2026-10-26 21:05:28.461915 UTC |
| Affected versions | Compute Engine before Google's managed-service remediation on August 31, 2026; the bulletin says the flaw allowed disk-data exfiltration without the required IAM permissions. |
| Fixed version | Google Cloud service remediation deployed August 31, 2026; no customer action required |
| CVSS base score | Not provided by the authority |
| CVSS severity | High |
| Exploitation status | Google Cloud does not state that this issue was maliciously exploited.; no exploitation claim is inferred. |
What Changed
Google Cloud disclosed an incorrect-authorization issue in Compute Engine and states that it patched the managed service on August 31, 2026.
What To Validate Now
- Inventory. Identify projects, Compute Engine resources, disks, sensitive data, IAM boundaries, owners, and workloads present before August 31, 2026.
- Establish applicability. Distinguish the managed-service authorization flaw from customer IAM misconfiguration; do not infer that disk data was accessed merely because Compute Engine was used.
- Remediate. Do not invent a customer patch: Google states that the service was patched and no customer action is required.
- Validate. Confirm current service status, document applicability, review Cloud Audit Logs and incident evidence only where risk and retention justify it, and retain the bulletin and assessment.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The authority provides a High severity but no CVSS base score and does not state that exploitation occurred. Avoid disruptive credential or disk changes without evidence or a separate control requirement.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
