The vulnerability involves unsafe Java deserialization of data received from a Redis-based external cache service, allowing an attacker to introduce malicious object payloads that the JVM will deserialize and execute. This flaw is classified under CWE-502 and, if exploited, can lead to arbitrary code execution on the host running Apache Kylin, potentially compromising confidentiality, integrity, and availability of the system.

Apache Kylin versions from 4.x up to 5.0.4 are affected. Users running these releases are at risk when the external cache component is reachable for untrusted data sources.

The CVSS score is not provided in the public data, but the nature of the flaw suggests a high severity if the deserialization is performed in a trusted context. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, indicating that no publicly known exploits are yet documented. Based on the description, the likely attack vector involves sending crafted data through the Redis cache endpoint, which is assumed to be exposed externally; successful exploitation would require network access to that endpoint and the ability to influence the cache contents.