All vulnerabilities
CVE-2026-81867

Deserialization of Untrusted Data in Application Integration allows Remote Code Execution

Google Cloud Application Integration
Open in ThreatlineRecord JSON
CVSS
9.4Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2026-06-28Fixed versionCVE List
Published28 Sep 2026Updated 30 Sep 2026CVE List

What fixes it

  • 2026-06-28Application IntegrationCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially crafted script bypassing param guards.

This vulnerability was patched on 28 June 2026, and no customer action is needed.

Text from CVE List

Affected versions 1

  • Application Integrationaffected: all versions before 2026-06-28CVE List

References 2