{"id":"CVE-2026-93327","kind":"vulnerability","aliases":["CVE-2026-93327"],"related":[],"title":"Google Cloud Application Integration: SubWorkflow task lets an authenticated user run code","description":"A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object.\n\n\nThis vulnerability was patched on 11 September 2026, and no customer action is needed.","summary":"The SubWorkflow task in Google Cloud Application Integration deserializes untrusted data without checking it, so a crafted serialized object can run code. An attacker needs an authenticated account to send it.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Application Integration","fixed":["2026-09-11"],"affected":"< 2026-09-11","ecosystem":"vendor"}],"ecosystems":[],"tags":["application-integration","auth-required","google-cloud","managed-service","vendor"],"not_affected_if":["auth-required","managed-hosting","managed-service-already-patched","patched-by-vendor"],"how_to_check":"No exposure check needed: it is a managed service patched by Google on 2026-09-11. Optionally review who has permission to create or edit integrations (IAM) and the integration change history from before that date.","fix":"Nothing to install. Google patched the managed Application Integration service on 2026-09-11 (GCP-2026-074); no customer action required.","status":"open","published_at":"2026-10-30T15:16:56+00:00","first_seen_at":"2026-10-30T15:31:12+00:00","triaged_at":"2026-10-30T15:33:03+00:00","updated_at":"2026-10-30T15:33:38+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-10-30T15:33:03Z","model":"claude-haiku-5-5","output":{"fix":"- Google Cloud Application Integration: versions prior to 2026-09-11 are affected; the description says it was patched on 11 September 2026 and no customer action is needed.","reach":"network","title":"Google Cloud Application Integration: SubWorkflow task lets an authenticated user run code","impact":"high","summary":"The SubWorkflow task in Google Cloud Application Integration deserializes untrusted data without checking it, so a crafted serialized object can run code. An attacker needs an authenticated account to send it.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["google-cloud","application-integration"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs in the integration service after a crafted serialized object is sent.","analyst_note":"Confirm the patch date and whether any customer-side step is needed, using the NVD entry and Google Cloud's security bulletin.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["managed-service-already-patched"],"who_is_affected":"Teams that run Google Cloud Application Integration workflows that use the SubWorkflow task are in scope. The sources say the vendor patched it on 11 September 2026 and no customer action is needed, so teams can confirm the service is current rather than change their own configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000668,"input_tokens":4155,"output_tokens":504,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the patch date and whether any customer-side step is needed, using the NVD entry and Google Cloud's security bulletin.","search":"'-09':83C '-11':84C '-2026':14A,17A '-93327':15A,18A '11':108C '2026':82C,110C 'account':61B 'action':114C 'allow':89C 'applic':3A,22B,40B,77C 'application':19A 'application-integr':21B 'arbitrari':95C 'attack':57B,92C 'auth':25B 'auth-requir':24B 'authent':9A,60B,91C 'check':46B 'cloud':2A,29B,39B,76C,87C 'code':12A,55B,96C 'craft':50B,100C 'custom':113C 'cve':13A,16A 'data':44B,68C 'deseri':42B,65C 'execut':94C 'googl':1A,28B,38B,75C,86C 'google-cloud':27B 'integr':4A,23B,41B,78C 'integration':20A 'let':7A 'malici':99C 'manag':31B 'managed-servic':30B 'need':58B,116C 'object':52B,102C 'patch':106C 'platform':88C 'prior':80C 'requir':26B 'run':11A,54B 'send':63B 'septemb':109C 'serial':51B,101C 'servic':32B 'subworkflow':5A,35B,72C 'task':6A,36B,73C 'untrust':43B,67C 'use':97C 'user':10A 'vendor':33B 'version':79C 'vulner':69C,104C 'without':45B","nicknames":[],"mitigations":[],"who_affected":"Anyone using Google Cloud Application Integration with the SubWorkflow task before 2026-09-11. An attacker needed an authenticated account that could submit a crafted serialized object. Google fixed it on its side, so customers can skip any update; an optional review of who could edit integrations is reasonable.","tier":"B","verified":{"fix":{"at":"2026-10-30T15:33:38Z","by":"analyst","doc":"https://docs.cloud.google.com/support/bulletins","run_id":1165},"who_affected":{"at":"2026-10-30T15:33:38Z","by":"analyst","doc":"https://docs.cloud.google.com/support/bulletins","run_id":1165}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear","cvss_by":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93327","severity":null,"published_at":"2026-10-30T15:16:56+00:00","modified_at":"2026-10-30T15:16:56+00:00","first_seen_at":"2026-10-30T15:31:12+00:00","fetched_at":"2026-10-30T15:31:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-93327:1165","url":null,"severity":null,"published_at":"2026-10-30T15:33:38+00:00","modified_at":"2026-10-30T15:33:38+00:00","first_seen_at":"2026-10-30T15:33:38+00:00","fetched_at":"2026-10-30T15:33:38+00:00","note":"Read Google Cloud bulletin GCP-2026-074 (published 2026-10-28): service-side fix deployed 2026-09-11, no customer action. No exploitation or PoC reported by the vendor; not searched on X (low-signal managed-service issue)."}],"documents":[{"id":24324,"url":"https://docs.cloud.google.com/support/bulletins","title":"Google Cloud Security Bulletins: GCP-2026-074","kind":"advisory","source":"analyst","publisher":null,"text":"GCP-2026-074, published 2026-10-28. A Deserialization of Untrusted Data vulnerability was discovered in the SubWorkflow task in Application Integration versions prior to September 11, 2026. No customer action is required. This vulnerability was patched on September 11, 2026. An authenticated user could use a maliciously crafted serialized object to execute arbitrary code. Severity: Critical. CVE-2026-93327.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}