What’s Vulnerable › Vulnerabilities
CVE-2026-93327: Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution
- Severity: critical (CVSS 9.4 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-30 · updated 2026-10-30
- Weakness: CWE-502
Description
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. This vulnerability was patched on 11 September 2026, and no customer action is needed.
Summary
CVE-2026-93327 is a critical (CVSS 9.4) unsafe Java deserialization flaw in the SubWorkflow task of Google Cloud Application Integration. An authenticated attacker can send a maliciously crafted serialized object to execute arbitrary code. It affects Application Integration versions prior to 2026-09-11 on Google Cloud Platform. The issue was patched on 11 September 2026 and no customer action is needed; it is not listed in CISA KEV.
CVE-2026-93327 ثغرة حرجة (CVSS 9.4) في إزالة تسلسل Java غير الآمن ضمن مهمة SubWorkflow في Google Cloud Application Integration. تتيح لمهاجم مصادق عليه تنفيذ تعليمات برمجية عشوائية عبر كائن متسلسل مصمم بشكل خبيث. تؤثر الثغرة في إصدارات Application Integration السابقة لـ 2026-09-11 على Google Cloud Platform. تم إصلاحها في 11 سبتمبر 2026 ولا يلزم أي إجراء من العملاء، وهي غير مدرجة في CISA KEV.
Affected products
- Google Cloud Application Integration: before 2026-09-11 — fixed in 2026-09-11
How to fix
Upgrade to a fixed version: Google Cloud Application Integration 2026-09-11. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-93327 or the next vulnerability affects your stack