CVE-2026-93327: Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution

Published Oct 30, 2026

Updated

A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object.

This vulnerability was patched on 11 September 2026, and no customer action is needed.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Google Cloud Application Integration to a version that resolves this vulnerability.
Fixed in 2026-09-11

Event History

Oct 30, 2026

CVE Published

via MITRE·02:56 PM

Data Sourced

via MITRE·02:56 PM

DescriptionWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who could exploit this issue?

An attacker must be authenticated and able to supply a maliciously crafted serialized object to a SubWorkflow task in Google Cloud Application Integration. No user interaction is required.

Which deployments were affected?

The issue affected Google Cloud Application Integration SubWorkflow tasks before the patch released on 11 September 2026. The available information does not identify any customer configuration changes or exclusions.

What should customers do?

No customer action is needed. Google Cloud patched the vulnerability on 11 September 2026.