SEPTEMBER 16, 2026
Live Feed
Back to database
Case File

CVE-2026-19407

HIGH · CVSS 7.7 EPSS 0.52% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-15 · Last synced 2026-09-16

CyberRota Analysis

AI-Generated

The Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 is vulnerable to bucket squatting, which can lead to remote code execution (RCE) and the theft of tenant-project tokens. This high-severity vulnerability poses significant risks to organizations utilizing the affected SDK, as it could allow attackers to execute arbitrary code and compromise sensitive project data. Organizations using this SDK should prioritize immediate updates to mitigate potential exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
remote code execution code execution

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-19407
Severity
HIGH
CVSS
7.7
EPSS
0.52%

Original NVD Description

Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution (RCE) and tenant-project token theft.