VULNERABILITY INTELLIGENCE
CVE-2026-19485
CVSS score9.3 CRITICAL
EPSS probability0.38%
CISA KEVNot currently listed
Published2026-08-26
Last modified2026-08-31
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/U:Clear
Description
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictable bucket names. This vulnerability was patched and no customer action is needed.
Weakness classification
- CWE-330: Use of Insufficiently Random Values