Deserialization Vulnerability in Google Cloud Application Integration
CVE-2026-81867

9.4CRITICAL

Key Information:

Vendor

Google Cloud

Status
Application Integration
Vendor
CVE Published:
28 September 2026

What is CVE-2026-81867?

A deserialization vulnerability in the JavaScript Task within Google Cloud Application Integration impacts versions before June 28, 2026. This security flaw permits an authenticated user with standard permissions to execute arbitrary code on shared production servers by utilizing a specially crafted script, thereby circumventing parameter guards. Google has issued a patch for this vulnerability, eliminating the risk without requiring any action from customers.

Affected Version(s)

Application Integration 0 < 2026-06-28

References

https://docs.cloud.google.com/support/bulletins#gcp-2026-065
https://docs.cloud.google.com/application-integration/doc...

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brahim Nah
.