CompaniesGoogle CloudMonthly reportsSeptember 2026
Google Cloud in September 2026: incidents, uptime and changes
1incidents posted
0labelled major or critical
100%free of major/critical
99.42%free of any incident
0price changes
0notable page changes
Vendor-reported outage time 0 min, incident time 4 h 10 min. Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours. Last 90 days.
By vendor label: Minor 1
Incidents 1
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| Multiple products in us-central1-b are experiencing network service degradation. | Minor | 4.2 h | resolved | 09-01 |
CVEs published
- CVE-2026-79707 Arbitrary File Read in Google Agent Development Kit (ADK) (CVSS 8.7)
- CVE-2026-4644 Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover (CVSS 8.5)
- CVE-2026-79696 Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist (CVSS 10.0)
- CVE-2026-13745 Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOME (CVSS 7.7)
- CVE-2026-19486 SSRF in Gemini Enterprise Agent Platform App Builder (CVSS 8.7)
- CVE-2026-19407 GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK (CVSS 7.7)
- CVE-2026-50572 Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault (CVSS 5.9)
- CVE-2026-73548 Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool (CVSS 7.5)
- CVE-2026-73552 Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values (CVSS 7.5)
- CVE-2026-73513 Envoy: oghttp2 upstream trailers incorrect handling (CVSS 7.5)
- CVE-2026-73549 Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters (CVSS 5.3)
- CVE-2026-48521 Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null (CVSS 5.9)
- CVE-2026-73547 Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check (CVSS 7.5)
- CVE-2026-73550 Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy (CVSS 7.5)
- CVE-2026-73512 Envoy: use-after-free in QUIC on internal redirects (CVSS 7.5)
- CVE-2026-73546 Envoy: Stored XSS in Admin Stats Interface (/stats?format=html) (CVSS 7.4)
- CVE-2026-73551 Envoy: Path normalization does not handle dot and dotdot segments with parameters (CVSS 5.3)
- CVE-2026-73553 Envoy: RBAC Authorization Bypass via Path Parameters (CVSS 7.5)
- CVE-2026-73511 Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat) (CVSS 5.3)
- CVE-2026-19759 Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution (CVSS 9.4)
- CVE-2026-81867 Deserialization of Untrusted Data in Application Integration allows Remote Code Execution (CVSS 9.4)
- CVE-2026-81375 Confused Deputy in Application Integration allows Internal File Read (CVSS 8.3)
Cite this
Google Cloud posted 1 status incident in September 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.
- Title
- Google Cloud in September 2026
- Vendor
- Google Cloud
- Date
- URL
- https://rewindex.com/company/google-cloud/2026/09