CVE-2026-81867

Published: Set 28, 2026 Last Modified: Set 28, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,4
Source: f45cbf4e-4146-4068-b7e1-655ffc2c548c
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially crafted script bypassing param guards.

This vulnerability was patched on 28 June 2026, and no customer action is needed.

502

Deserialization of Untrusted Data

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Availability Other
Potential Impacts:
Modify Application Data Unexpected State Dos: Resource Consumption (Cpu) Varies By Context
Applicable Platforms
Languages: Java, Ruby, PHP, Python, JavaScript
Technologies: Not Technology-Specific, ICS/OT, AI/ML
Likelihood of Exploit: Medium
View CWE Details
https://docs.cloud.google.com/application-integration/docs/…
https://docs.cloud.google.com/application-integration/docs/security-bulletins#g…
https://docs.cloud.google.com/support/bulletins#gcp-2026-065
https://docs.cloud.google.com/support/bulletins#gcp-2026-065