Description
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object.


This vulnerability was patched on 11 September 2026, and no customer action is needed.
Published: 2026-10-30
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: No action required
AI Analysis

Impact

A flaw in the SubWorkflow task of Google Cloud Application Integration allows an authenticated attacker to deserialize a maliciously crafted Java object, leading to arbitrary code execution. This unsanitized Java deserialization issue (CWE‑502) bypasses input validation and can run any code supplied by the attacker, compromising confidentiality, integrity, and availability of the affected services.

Affected Systems

The vulnerability affects Google Cloud Application Integration services running any version released before 2026‑09‑11 on Google Cloud Platform. All releases published on or after 11 September 2026 contain the patch and are not affected.

Risk and Exploitability

The CVSS score of 9.4 indicates critical severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, meaning no publicly documented exploits are known currently. The attack requires an authenticated session to the SubWorkflow API; therefore, only accounts with permissions to invoke integration workflows can exploit the flaw. Once authenticated, an attacker can exploit the deserialization mechanism to run arbitrary code, presenting a high risk to any services exposed to such credentials.

Generated by OpenCVE AI on October 30, 2026 at 18:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Ensure all Google Cloud Application Integration instances run the patched release version 2026‑09‑11 or later.
  • Restrict SubWorkflow API usage to only accounts that absolutely need it, limiting exposure.
  • Monitor workflow execution logs for anomalous activity that may indicate attempted exploitation.

Generated by OpenCVE AI on October 30, 2026 at 18:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. This vulnerability was patched on 11 September 2026, and no customer action is needed.
Title Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution
Weaknesses CWE-502
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GoogleCloud

Published:

Updated: 2026-10-30T17:18:22.927Z

Reserved: 2026-09-17T17:25:35.528Z

Link: CVE-2026-93327

cve-icon Vulnrichment

Updated: 2026-10-30T17:08:52.234Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-30T15:16:56.867

Modified: 2026-10-30T19:37:07.073

Link: CVE-2026-93327

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T18:45:14Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data