9.3
Critical
CVE-2026-19485 A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce…
Description
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictable bucket names. This vulnerability was patched and no customer action is needed.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Vertex AI Search for Commerce 2026 | earliest → < 2026-04-27 | 2026-04-27 |
References
- unit42.paloaltonetworks.com unit42.paloaltonetworks.com
Timeline
- Published
- Last modified