The vulnerability resides in the Process Variable Serialization System of Alfresco Activiti, specifically the deserialize/createObjectInputStream method in SerializableType.java. An attacker can craft malicious serialized data that triggers the Java deserialization routine, which is marked as a flaw that allows remote exploitation. Based on the description, it is inferred that the flaw could enable remote code execution or other destructive actions on the host. The weakness is rooted in improper input validation and deserialization of untrusted data, aligning with CWE‑20 and CWE‑502.

Vendors affected include Alfresco: Activiti. The flaw is present in all releases up to version 7.19 and 8.8.0, inclusive. No affected version information beyond those in the CNAs is provided, so any deployment earlier than 7.20 or 8.8.1 should be considered vulnerable.

The CVSS score is 5.3 (Medium) with an EPSS score of less than 1% and no listing in the KEV catalog, which suggests a modest but non‑negligible risk. However, the description explicitly states that the exploit has been published and may be used, indicating that the vulnerability is actively exploited in the wild at a low probability. The attack vector is remote, presumably via ingestion of malicious process variables, and requires no local privileges.