EUVD-2026-88212
GHSA-33v3-56q5-h52m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Network-reachable, low-complexity RCE by a standard authenticated user (PR:L); scope changes (S:C) because code runs on shared multi-tenant servers impacting other tenants, with full C/I/A loss.
Primary rating from Vendor (f45cbf4e-4146-4068-b7e1-655ffc2c548c).
CVSS VectorVendor: f45cbf4e-4146-4068-b7e1-655ffc2c548c
Lifecycle Timeline
3DescriptionCVE.org
A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially crafted script bypassing param guards.
This vulnerability was patched on 28 June 2026, and no customer action is needed.
AnalysisAI
Arbitrary code execution in Google Cloud Application Integration (versions prior to 2026-06-28) allows an authenticated user holding only standard permissions to run code on shared, multi-tenant production servers by crafting a JavaScript Task script that bypasses the platform's built-in parameter guards and reaches an unsafe deserialization path. The CVSS 4.0 base score is 9.4, and because the flaw breaches the tenant trust boundary the subsequent-system metrics are also High, meaning other customers on the same shared infrastructure are exposed rather than just the attacker's own tenant. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Google Cloud Application Integration user holding only standard permissions, with the ability to create or edit a JavaScript Task, and a crafted script that bypasses the built-in parameter guards to reach the unsafe deserialization path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 9.4 (AV:N/AC:L/PR:L/UI:N with VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H) accurately reflects a severe flaw: an authenticated user with only standard permissions could achieve arbitrary code execution on shared, multi-tenant production servers, meaning the impact crosses a trust boundary to affect other tenants (the high subsequent-system metrics). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Google remediated CVE-2026-81867 server-side in the 2026-06-28 service release, and all Application Integration versions prior to that date are fixed automatically, so the primary action is to confirm that your tenant is consuming the current service release and that no pinned or cached pre-2026-06-28 behavior remains in use. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm with your cloud platform team that no Google Cloud Application Integration instances remain on tenant versions prior to the 2026-06-28 server-side remediation, and request written confirmation from Google or your account team that the fix has been applied to your organization's tenancy and region. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today