This vulnerability was patched on 28 June 2026, and no customer action is needed.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Google Cloud | Application Integration | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Mon, 28 Sep 2026 11:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially crafted script bypassing param guards. This vulnerability was patched on 28 June 2026, and no customer action is needed. | |
| Title | Deserialization of Untrusted Data in Application Integration allows Remote Code Execution | |
| Weaknesses | CWE-502 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GoogleCloud
Published:
Updated: 2026-09-28T10:49:16.416Z
Reserved: 2026-08-27T17:44:48.468Z
Link: CVE-2026-81867
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-28T11:16:48.070
Modified: 2026-09-28T11:16:48.070
Link: CVE-2026-81867
Redhat
No data.
OpenCVE Enrichment
No data.