Security readout for executives and security teams
Plain-English summary
A flaw in Google Cloud’s managed import process used predictable storage bucket names. Someone who knew a customer’s project number could potentially read or alter staged BigQuery data and error logs. Google states it patched the service on 27 April 2026 and customers need take no action.
Executive priority
Treat this as a high-priority historical exposure review, not an emergency patching exercise. Confirm whether the affected import workflow was used and whether sensitive information was staged. Escalate only if audit evidence indicates unauthorized access or modification.
Technical view
Vertex AI Search for Commerce’s BigQuery import staging used predictable resource names before 27 April 2026. This could permit bucket squatting and unauthorized read/write access to staged data and error logs. The supplied CVSS 4.0 score is 9.3, reflecting serious confidentiality and integrity impact without availability impact.
Likely exposure
Potential historical exposure is limited to Vertex AI Search for Commerce environments using the affected BigQuery import staging process before 27 April 2026. The bundle does not establish which customers used that process, how long staged information remained accessible, or whether any customer data was actually accessed.
Exploitation context
The CVE is not listed as KEV, and the supplied sources do not establish active exploitation. The vulnerability was network-accessible, low complexity, and rated as requiring low privileges. Knowledge of a victim’s project number and predictable bucket naming were central to the reported risk.
Researcher notes
The weakness is classified as CWE-330 and described as predictable resource naming enabling bucket squatting. The machine-readable affected version value of “0” is not operationally informative; use the narrative cutoff of 27 April 2026. Evidence provided does not support claims of model compromise, persistence, or confirmed exploitation.
Mitigation direction
- No customer patch deployment is required; Google states the managed service has already been patched.
- Check current Google Cloud security guidance for any updated customer-specific recommendations.
- If suspicious access is found, preserve evidence and initiate the established cloud incident-response process.
Validation and detection
- Inventory relevant projects that used Vertex AI Search for Commerce BigQuery imports before 27 April 2026.
- Confirm through Google Cloud guidance or support that each relevant managed environment received the platform patch.
- Review available audit records for unexpected access to staging buckets, staged data, or error logs during the affected period.
- Document whether sensitive data entered staging and whether suspicious read or write activity occurred.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-330: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-19485 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/U:Clear
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/U:Clear——GoogleCloudVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/U:Clear
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/CVE reference, GoogleCloud
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Insufficiently Random Values
Use of Insufficiently Random Values represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.