CVE-2026-19407CWE-330

CVE-2026-19407

published September 15, 2026

CVSS
7.7
EPSS
1%
Percentile
43.4
In the wild
Unconfirmed
What it is

Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution (RCE) and tenant-project token theft.

The record
Technical detail
CVSS
7.7 · NONE
CVSS v4.0
7.7 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Clear
EPSS
0.00521 · 43.4th percentile
Weakness
CWE-330 · Use of Insufficiently Random Values
Published
2026-09-15T20:17Z
References (1)
https://docs.cloud.google.com/gemini-enterprise-agent-platform/release-notes#March_31_2026 · f45cbf4e-4146-4068-b7e1-655ffc2c548c
EPSS history
Timeline
  • 17 SEP 03:28Z
    EPSS moved — → 1%
    epss
  • 15 SEP 15:22Z
    GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK
    cvelistv5