The vulnerability results from missing authorization checks in Hazelcast’s IMap Predicates API. A client with limited privileges can use this API to execute arbitrary code on a Hazelcast cluster member. The ability to run arbitrary code can lead to full compromise of that member, affecting the confidentiality, integrity, and availability of all data stored within the cluster.

Affected vendors and products: Hazelcast Community and Enterprise editions. Versions before 5.4.5, 5.5.10, 5.6.1, and 5.7.0 contain the flaw. The issue is resolved in 5.4.5, 5.5.10, 5.6.1, 5.7.0, and later releases.

The CVSS score of 8.7 indicates high severity. EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, an attacker only needs remote access to a client session with limited privileges; the missing authorization allows the attacker to invoke the IMap Predicates API and run code on a cluster member. The exploit path is straightforward and does not require additional prerequisites, making the risk significant for exposed clusters.