Google to Issue CVEs for Critical Cloud Vulnerabilities

Google Cloud has announced a significant step forward in its commitment to transparency and security by stating it will begin issuing Common Vulnerabilities and Exposures (CVEs) for critical vulnerabilities found in its cloud services.

This move, which underscores Google’s dedication to helping enterprises and government agencies protect against potential security threats, is set to enhance visibility and trust in Google Cloud’s security practices, even when no direct customer action is required.

In a statement released today, Google Cloud confirmed that it will now assign CVEs to critical vulnerabilities in its Google Cloud services, even in cases where no immediate patching or customer intervention is necessary.

This decision is aimed at bolstering awareness and fostering transparency across the ecosystem.

To distinguish these vulnerabilities and avoid unnecessary concern, the company will tag such CVEs with the label “exclusively-hosted-service,” indicating that no action is required from customers.

“Transparency and shared action, to learn from and mitigate whole classes of vulnerability, is a vital part of countering bad actors. We will continue to lead and innovate across the community of defenders,” said Phil Venables, Chief Information Security Officer (CISO) of Google Cloud.

Free Ultimate Continuous Security Monitoring Guide - Download Here (PDF)

Commitment to Transparency and Security

Google’s announcement aligns with findings from the Cyber Safety Review Board (CSRB), which has highlighted the importance of strong security practices to prevent breaches and system compromises.

The CSRB’s recent report on Storm-0558, an advanced persistent threat (APT) group that exploited vulnerabilities to access email accounts of several organizations, including government agencies, demonstrated the critical need for transparency and accountability among cloud service providers.

Google Cloud’s decision to issue CVEs is seen as a proactive measure to address these concerns and promote security best practices.

Google Cloud’s latest move builds on its 20-year history of collaboration with external security researchers.

Since launching its first CVE Numbering Authority (CNA) in 2011, Google has issued more than 8,000 CVEs for its consumer and enterprise products.

Its partnership with MITRE, the organization managing the CVE system, expanded in 2022 when Google became one of MITRE’s four Top-Level Roots, further cementing its leadership in the field of vulnerability reporting.

Through initiatives such as the Cloud Vulnerability Reward Program (VRP), Google has fostered a culture of collaboration between its engineers and external security researchers.

Now, by issuing CVEs for its cloud vulnerabilities, Google continues to lead the way in advancing security practices across the entire cloud services ecosystem.

Today’s announcement is part of Google Cloud’s broader “shared fate” model, where the company works closely with customers to improve security continuously.

By making critical vulnerabilities publicly trackable via CVEs, Google Cloud aims to empower its customers, partners, and the security community to better assess and address potential risks.

Analyze Unlimited Phishing & Malware with ANY.RUN For Free - 14 Days Free Trial.