Wednesday, April 30, 2025
HomeCloudGoogle to Issue CVEs for Critical Cloud Vulnerabilities

Google to Issue CVEs for Critical Cloud Vulnerabilities

Published on

SIEM as a Service

Follow Us on Google News

Google Cloud has announced a significant step forward in its commitment to transparency and security by stating it will begin issuing Common Vulnerabilities and Exposures (CVEs) for critical vulnerabilities found in its cloud services.

This move, which underscores Google’s dedication to helping enterprises and government agencies protect against potential security threats, is set to enhance visibility and trust in Google Cloud’s security practices, even when no direct customer action is required.

In a statement released today, Google Cloud confirmed that it will now assign CVEs to critical vulnerabilities in its Google Cloud services, even in cases where no immediate patching or customer intervention is necessary.

- Advertisement - Google News

This decision is aimed at bolstering awareness and fostering transparency across the ecosystem.

To distinguish these vulnerabilities and avoid unnecessary concern, the company will tag such CVEs with the label “exclusively-hosted-service,” indicating that no action is required from customers.

“Transparency and shared action, to learn from and mitigate whole classes of vulnerability, is a vital part of countering bad actors. We will continue to lead and innovate across the community of defenders,” said Phil Venables, Chief Information Security Officer (CISO) of Google Cloud.

Free Ultimate Continuous Security Monitoring Guide - Download Here (PDF)

Commitment to Transparency and Security

Google’s announcement aligns with findings from the Cyber Safety Review Board (CSRB), which has highlighted the importance of strong security practices to prevent breaches and system compromises.

The CSRB’s recent report on Storm-0558, an advanced persistent threat (APT) group that exploited vulnerabilities to access email accounts of several organizations, including government agencies, demonstrated the critical need for transparency and accountability among cloud service providers.

Google Cloud’s decision to issue CVEs is seen as a proactive measure to address these concerns and promote security best practices.

Google Cloud’s latest move builds on its 20-year history of collaboration with external security researchers.

Since launching its first CVE Numbering Authority (CNA) in 2011, Google has issued more than 8,000 CVEs for its consumer and enterprise products.

Its partnership with MITRE, the organization managing the CVE system, expanded in 2022 when Google became one of MITRE’s four Top-Level Roots, further cementing its leadership in the field of vulnerability reporting.

Through initiatives such as the Cloud Vulnerability Reward Program (VRP), Google has fostered a culture of collaboration between its engineers and external security researchers.

Now, by issuing CVEs for its cloud vulnerabilities, Google continues to lead the way in advancing security practices across the entire cloud services ecosystem.

Today’s announcement is part of Google Cloud’s broader “shared fate” model, where the company works closely with customers to improve security continuously.

By making critical vulnerabilities publicly trackable via CVEs, Google Cloud aims to empower its customers, partners, and the security community to better assess and address potential risks.

Analyze Unlimited Phishing & Malware with ANY.RUN For Free - 14 Days Free Trial.

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

Researchers Uncovered RansomHub Operation and it’s Relation With Qilin Ransomware

Security researchers have identified significant connections between two major ransomware-as-a-service (RaaS) operations, with evidence...

Researchers Turned Azure Storage Wildcards into a Stealthy Internal SOCKS5 Backdoor

Security researchers at Quarkslab have developed a new covert channel technique that exploits Microsoft's...

Cybercriminals Trick Tenants into Sending Rent to Fraudulent Accounts

Proofpoint, a leading cybersecurity firm, has identified and named a new financially motivated Business...

New WordPress Malware Disguised as Anti-Malware Plugin Takes Full Control of Websites

The Wordfence Threat Intelligence team has identified a new strain of WordPress malware that...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Researchers Uncovered RansomHub Operation and it’s Relation With Qilin Ransomware

Security researchers have identified significant connections between two major ransomware-as-a-service (RaaS) operations, with evidence...

Researchers Turned Azure Storage Wildcards into a Stealthy Internal SOCKS5 Backdoor

Security researchers at Quarkslab have developed a new covert channel technique that exploits Microsoft's...

Cybercriminals Trick Tenants into Sending Rent to Fraudulent Accounts

Proofpoint, a leading cybersecurity firm, has identified and named a new financially motivated Business...