The vulnerability exists in the JSONSerializer and CBORSerializer components of APScheduler. During deserialization, the unmarshal_object function can dynamically import any Python module and invoke its __setstate__ method, enabling an attacker to instantiate arbitrary classes and inject state that is then executed within the application context. This flaw is categorized as insecure deserialization and corresponds to CWE‑502. The result is the ability to run arbitrary code on the host that runs the application.

Any Python application that imports the APScheduler library and utilizes the JSONSerializer or CBORSerializer, including all released 3.10.x versions and the experimental 4.0.0a5 build, is vulnerable. The flaw is present once the serializers are invoked; therefore any environment where APScheduler is installed and the serialization functionality is exposed is at risk.

The CVSS score of 9.8 marks this as a high‑severity issue. The EPSS score of 0.00061 indicates a very low probability of exploitation and the flaw is not yet listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote network exploitation through an endpoint that accepts serialized data, though local exploitation is also possible if a user can supply a crafted payload to the application. The exploitation path is straightforward: deliver a malicious JSON or CBOR payload and the vulnerable deserializer will load and execute the attacker‑specified classes, resulting in full code execution on the target system. The potential impact is severe, warranting immediate attention.