The vulnerability involves unsafe Java deserialization of data received from a Redis-based external cache service, allowing an attacker to introduce malicious object payloads that the JVM will deserialize and execute. This flaw is classified under CWE-502 and, if exploited, can lead to arbitrary code execution on the host running Apache Kylin, potentially compromising confidentiality, integrity, and availability of the system.

Apache Kylin versions from 4.x up to 5.0.4 are affected. Users running these releases are at risk when the external cache component is reachable for untrusted data sources.

The CVSS score is 9.8, indicating critical severity for remote code execution via unsafe Java deserialization. The EPSS score is < 1%, suggesting a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog, so no public exploits are documented. Based on the description, the likely attack vector involves sending crafted data through the Redis cache endpoint, which is presumed to be reachable from external or untrusted sources; successful exploitation would require network access to that endpoint and the ability to influence the cache contents.