CVE-2026-19485: CWE-330 Use of Insufficiently Random Values in Google Cloud Vertex AI Search for Commerce
Description
CVE-2026-19485 is a critical vulnerability in Google Cloud Vertex AI Search for Commerce prior to 2026-04-27. It involves predictable resource names in the BigQuery Import Staging component, allowing an attacker who knows a victim's project number to gain read/write access to staged data and error logs. This vulnerability has been patched by Google, and no customer action is required. The vulnerability has a CVSS 4.0 score of 9.3, indicating high severity. It affects the cloud service hosted by Google Cloud Platform.
CVSS v4.0
Score 9.3critical
Affected software
Google Cloud
Vertex AI Search for Commerce
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-19485) is due to the use of insufficiently random values (CWE-330) in the naming of resources within the BigQuery Import Staging feature of Google Cloud Vertex AI Search for Commerce. Predictable bucket names allow an attacker with knowledge of a project number to access sensitive staged data and error logs with read/write permissions. The issue affects versions prior to 2026-04-27 and has been addressed by Google in a patch. Since this is a cloud service, Google manages the remediation server-side.
Potential Impact
An attacker who knows the victim's Google Cloud project number can exploit predictable bucket names to obtain unauthorized read and write access to sensitive staged data and error logs in the affected service. This could lead to data exposure and potential data manipulation within the staging environment of Vertex AI Search for Commerce. The vulnerability is rated critical with a CVSS score of 9.3.
Mitigation Recommendations
Google has patched this vulnerability in the cloud service as of 2026-04-27. No customer action is required because the vendor manages remediation for this cloud-hosted service. Users should verify the vendor advisory for confirmation but can consider this issue resolved.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GoogleCloud
- Date Reserved
- 2026-08-10T16:19:58.910Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 6a8f3604acd9273b49426227
Added to database: 08/26/2026, 18:52:52 UTC
Last enriched: 09/09/2026, 16:37:44 UTC
Last updated: 10/10/2026, 06:48:15 UTC
Views: 65
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.