Description
A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially crafted script bypassing param guards.


This vulnerability was patched on 28 June 2026, and no customer action is needed.
Published: 2026-09-28
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 11:00:00 +0000

Type Values Removed Values Added
Description A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially crafted script bypassing param guards. This vulnerability was patched on 28 June 2026, and no customer action is needed.
Title Deserialization of Untrusted Data in Application Integration allows Remote Code Execution
Weaknesses CWE-502
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GoogleCloud

Published:

Updated: 2026-09-28T10:49:16.416Z

Reserved: 2026-08-27T17:44:48.468Z

Link: CVE-2026-81867

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-28T11:16:48.070

Modified: 2026-09-28T11:16:48.070

Link: CVE-2026-81867

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data