Is CVE-2026-85299 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85299 being exploited in the wild.

How severe is CVE-2026-85299?

High severity, published 27 October 2026.

Which products and versions are affected?

Google Compute Engine prior to August 31, 2026.

Is there a fix for CVE-2026-85299?

Yes: fixed in Patched on August 31, 2026. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85299 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-85299?

Check whether you run Google Compute Engine or Google Cloud Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85299: Google Compute Engine incorrect authorization in disk access

CVE-2026-85299 · Severity: high · Published 2026-10-27

Google Compute Engine, the cloud platform's core virtual machine service, contained an authorization flaw that allowed users to read disk data they should not have had access to. An attacker with limited Compute Engine permissions could exfiltrate sensitive data stored on virtual machine disks. Google patched this vulnerability on August 31, 2026, and no further action is required for customers.

Technologies: Google Cloud Platform. Vendors: Google.

Quick answers

Is CVE-2026-85299 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85299 being exploited in the wild.
How severe is CVE-2026-85299?: High severity, published 27 October 2026.
Which products and versions are affected?: Google Compute Engine prior to August 31, 2026.
Is there a fix for CVE-2026-85299?: Yes: fixed in Patched on August 31, 2026. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85299 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-85299?: Check whether you run Google Compute Engine or Google Cloud Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Patched on August 31, 2026

Technical details

An improper authorization check in Compute Engine allowed authenticated users to bypass IAM permission controls and exfiltrate disk data. The vulnerability required the attacker to have existing Compute Engine access but no specific elevated permissions. The flaw was fixed on August 31, 2026, with no evidence of exploitation in the wild.

Affected products

Google Compute Engine prior to August 31, 2026

Timeline

2026-08-31: patched
2026-10-26: disclosed

References

https://docs.cloud.google.com/support/bulletins/index

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.