# CVE-2026-81867

Authenticated RCE via JS Task deserialization in Google Cloud Application Integration (patched).

- Page: https://www.vulneraibility.com/cve/CVE-2026-81867
- CVSS: 9.4
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.36% (percentile 29.7)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-09-30)
- Weakness: CWE-502
- Published: 2026-09-28

## Affected versions

- Google Cloud Application Integration: affected < 2026-06-28

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated users can execute arbitrary code on shared production servers via crafted JavaScript Task deserialization, risking RCE, data exposure, and tenant compromise.

## Action

Monitor only

## Recommendation

Confirm Google's patch applied; review audit logs for suspicious activity.

## References

- [other] https://docs.cloud.google.com/support/bulletins#gcp-2026-065
- [other] https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-065

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.