Description
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object.
This vulnerability was patched on 11 September 2026, and no customer action is needed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Google Cloud | Application Integration | < 2026-09-11 | 2026-09-11 |
Advisories 1
- WID-SEC-2026-4228 Google Cloud Platform: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Nov 1, 2026