Threat Investigation
Request a demo

CVE-2026-85267

High

Description

A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was patched on 22 July 2026, and no customer action is needed.

SeverityHigh
CVSS8.7
Exploit probability—
ProductCloud Shell
PublishedOct 20, 2026
First seenOct 20, 2026
Weakness typeCWE-1385CWE-1385

How to fix

Update
  • Google Cloud Cloud Shell2026-07-22 or later

Affected products

ProductAffected versionsFixed in
Google Cloud Cloud Shellv < 2026-07-222026-07-22

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.