The vulnerability arises from insecure deserialization of objects transmitted between the client and the Layer 7 API Gateway. An attacker who intercepts and modifies the traffic can force the gateway to instantiate arbitrary objects. Because the gateway processes these objects before enforcing security checks, the attacker could break security expectations or trigger remote code execution. The weakness is classified as CWE‑502, insecure deserialization.

Broadcom Layer 7 API Gateway is affected. No specific version information is provided in the advisory, so all releases of the product are potentially impacted until a fix is released.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, so the likelihood of widespread exploitation is currently uncertain. The description specifies that an attacker must be able to perform a man‑in‑the‑middle between the client and the gateway, implying a network‑level compromise or compromised endpoint. If such conditions exist, the attacker could deploy malicious payloads that, after deserialization, execute code on the gateway. No public exploit is reported, but the potential for remote code execution warrants careful monitoring.