This vulnerability involves deserialization of untrusted data in the JavaScript Task within Google Cloud Application Integration versions before 2026-06-28. An authenticated user with standard permissions could exploit this flaw by submitting a specially crafted script to bypass parameter guards, resulting in arbitrary code execution on shared production servers. The issue was addressed by Google with a patch released on June 28, 2026. The vulnerability has a CVSS 4.0 score of 9.4, indicating critical severity. The vendor advisory confirms that remediation has been applied and no customer action is necessary.

An authenticated user with standard permissions could run arbitrary code on the shared production servers of Google Cloud Application Integration, potentially compromising the integrity and confidentiality of the service environment. This could lead to unauthorized actions within the shared infrastructure. However, since the vulnerability is patched and no known exploits are reported in the wild, the immediate risk is mitigated for updated environments.

This vulnerability was officially patched by Google on June 28, 2026. As this is a cloud-hosted service, Google manages the remediation server-side, and no customer action is required. Customers should verify that their environments are updated and consult the official Google advisory at https://docs.cloud.google.com/support/bulletins#gcp-2026-065 for confirmation.