---
id: CVE-2026-93327
title: >-
  Unsafe Java Deserialization in Application Integration SubWorkflow tasks
  allows Remote Code Execution
summary: >-
  A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in
  Google Cloud Application Integration versions prior to 2026-09-11 on Google
  Cloud Platform allows an authenticated attacker to execute arbitrary code
  using a ma…
severity: critical
cvss: 9.4
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear'
cvssSource: cna
cwe:
  - CWE-502
vendor: Google Cloud
product: Application Integration
affected:
  - application_integration < 2026-09-11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T16:02:03.590907Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T17:18:22.927Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-93327'
references:
  - url: 'https://docs.cloud.google.com/support/bulletins'
tags:
  - cve.org
epss: 0.00394
epssPercentile: 0.33761
ingestedAt: '2026-11-05T16:24:31.167Z'
---

## Overview

A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object.


This vulnerability was patched on 11 September 2026, and no customer action is needed.

## Affected

- `application_integration < 2026-09-11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.