{"id":"CVE-2026-93327","aliases":[],"cve":{"records":[{"id":"CVE-2026-93327","source":"GoogleCloud","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-17T17:25:35.528Z","published":"2026-10-30T14:56:39.383Z","modified":"2026-10-30T17:18:22.927Z"}],"publishers":[{"name":"GoogleCloud","role":"CNA","organizationId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","modified":"2026-10-30T14:56:39.383Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T17:18:22.927Z"}],"references":[{"url":"https://docs.cloud.google.com/support/bulletins","tags":[],"source":"GoogleCloud"}],"weaknesses":[{"id":"CWE-502","description":"CWE-502 Deserialization of Untrusted Data","source":"GoogleCloud"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T16:02:03.590907Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution","titleSource":"GoogleCloud","descriptionSource":"GoogleCloud","description":"A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object.\n\n\nThis vulnerability was patched on 11 September 2026, and no customer action is needed.","score":9.4,"severity":"critical","published":"2026-10-30T14:56:39.383Z","modified":"2026-10-30T17:18:22.927Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Google Cloud","name":"Application Integration","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"2026-09-11","versionType":"date"}],"defaultStatus":"unaffected","cpes":[],"source":"GoogleCloud","url":"https://www.cve.org/CVERecord?id=CVE-2026-93327"}],"remediation":[],"references":["https://docs.cloud.google.com/support/bulletins"],"sources":[{"name":"CVE","id":"CVE-2026-93327","modified":"2026-10-30T17:18:22.927Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93327"}],"assessments":[{"source":"GoogleCloud","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear","score":9.4}],"sourceAffected":[],"observedAt":"2026-10-30T17:26:46.881Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T10:20:31.211Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T17:30:32.129Z","attemptedAt":"2026-10-30T17:30:32.129Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T17:30:32.425Z","attemptedAt":"2026-10-30T17:30:32.425Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T17:30:32.000Z","attemptedAt":"2026-10-30T17:30:32.000Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T17:30:32.579Z","attemptedAt":"2026-10-30T17:30:32.579Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-114008","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-114008","modified":"Oct 30, 2026, 2:56:39 PM","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear","checkedAt":"2026-10-30T17:30:32.000Z"},{"source":"NVD","id":"CVE-2026-93327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93327","modified":"2026-10-30T15:16:56.867","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear","checkedAt":"2026-10-30T17:30:32.129Z"},{"source":"GitHub Advisory Database","id":"GHSA-22c9-7ph7-qxcx","url":"https://github.com/advisories/GHSA-22c9-7ph7-qxcx","modified":"2026-10-30T15:34:51Z","checkedAt":"2026-10-30T17:30:32.425Z"}],"aiSummary":null}