Vulnerability · Published Oct 30, 2026 · Assigned by GoogleCloud
CVE-2026-93327Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution
Critical 9.4
In plain English
A critical-severity unsafe deserialization in Application Integration from Google Cloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Official description
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. This vulnerability was patched on 11 September 2026, and no customer action is needed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google Cloud | Application Integration | 0 – before 2026-09-11 |
Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear