The vulnerability is a TOCTOU race condition that occurs when Apache Tomcat creates Unix domain sockets using the APR/Native connector. An unauthorised local user can exploit this to gain access to the socket file, potentially bypassing intended access controls and executing operations that should be restricted to the Tomcat process. This flaw represents a local privilege escalation and information exposure.

The flaw impacts Apache Tomcat versions from 9.0.47 through 9.0.122 inclusive. All installations that employ the APR/Native connector for handling HTTP requests are susceptible. Users running these affected releases should plan to update to 9.0.123 or later.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of < 1% shows that the likelihood of exploitation is very small. The vulnerability is locally exploitable: it requires the attacker to be a user on the same host and to have permission to create or bind a socket. No evidence exists that it is listed in the CISA KEV catalog. Because the flaw is not tied to a network-facing vector, the threat surface is confined to local privilege escalation opportunities.