Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Google Cloud Application Integration can run attacker code

CVE-2026-81867 · published 14 days ago
Summary

When using older versions of Google Cloud Application Integration, a regular user could create a specially crafted script that would make the shared production servers run whatever code they wanted. This could let an attacker take control of the environment. The problem was fixed on June 28, 2026, and no further action is required from customers.

What to do
  • Update google cloud application integration to version 2026-06-28 or later.
Affected software
VendorProductAffected versions
google cloud application integration < 2026-06-28
Original advisory text
Deserialization of Untrusted Data in Application Integration allows Remote Code Execution
A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially crafted script bypassing param guards.


This vulnerability was patched on 28 June 2026, and no customer action is needed.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published28 Sep 2026
Updated12 Oct 2026
First seen28 Sep 2026
Sources
CVE-2026-81867 · NVD
CVE-2026-81867 · MITRE
Track software like this
Free during beta