GCP-2026-074
Published: 2026-10-28 Description Description Severity Notes A Deserialization of Untrusted Data vulnerability was discovered in the SubWorkflow task in Application Integration versions prior to September 11, 2026. What should I do? No customer action is required. This vulnerability was patched on September 11, 2026. What vulnerabilities are being addressed? An authenticated user could use a maliciously crafted serialized object to execute arbitrary code. Critical CVE-2026-93327
Read at Google Cloud Security Bulletins
- Vendor
- Product
- PHP
- EPSS
- 1.00 (p100)
- Fix
- available
- Exposure class
- Web platform
Why it ranks 51 (High)
- EPSS 1.00 (high probability of exploitation)
- Product class: web platform
- Widely deployed vendor product (Google)
- Covered by 38 independent sources
- Fix available
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Google Cloud Security Bulletins (docs.cloud.google.com)
- CVE-2026-93327 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-85299 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.