Google Application Integration CVE-2026-93327

Requires an authenticated attacker (CVSS PR:L) with access to Google Cloud Application Integration and the ability to supply a maliciously crafted serialized object to a SubWorkflow task; only versions of the service prior to 2026-09-11 are affected. Key limiting factors: authentication to the Google Cloud tenant/service is mandatory (not remotely exploitable by anonymous attackers), exploitation is confined to the SubWorkflow task handling path, and Google has already applied the fix server-side for all customers with no action required - so unpatched instances should not persist in the managed environment. The exact feature-level prerequisites for reaching the vulnerable deserialization path are not detailed in the available sources.

Signals are mostly aligned toward high severity but with one decisive mitigating fact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with full high impact to both the vulnerable system and subsequent systems (VC/VI/VA:H, SC/SI/SA:H) yields a 9.4 Critical score, and CWE-502 deserialization-to-RCE is a classic high-reliability bug class; the vuln.today Decision label is act_now. However, PR:L confirms this is NOT unauthenticated - an attacker must already hold authenticated access to Google Cloud Application Integration. The single most important signal is that this is a vendor-managed Google Cloud service that Google states was patched server-side on 2026-09-11 with 'no customer action needed,' so for current deployments the practical exposure window is effectively closed. No EPSS score is provided and there is no CISA KEV listing, so widespread active exploitation is not indicated; the reference is only Google's support bulletin, with no PoC. Net: a genuinely critical vulnerability class and an act_now label, but the real residual customer risk is low because the platform is already remediated for all tenants - the act_now urgency is best read as historical/at-disclosure rather than reflecting ongoing customer action required.

An authenticated user of Google Cloud Application Integration crafts a malicious serialized object and submits it through a SubWorkflow task, where unsafe deserialization causes the crafted object to execute attacker-controlled code within the service. No public exploit code or PoC is identified; the specific trigger mechanics beyond 'maliciously crafted serialized object' are not described in the available sources. Because Google patched the service on 2026-09-11, the scenario applies only to the pre-patch window.