This vulnerability in flowcraft Advanced Personalization (<= 1.1.2) involves deserialization of untrusted data, which allows an attacker to perform object injection. This can lead to remote code execution or other severe impacts due to the critical nature of deserialization flaws. The CVSS 3.1 base score is 9.8, reflecting network exploitability without privileges or user interaction, and full impact on confidentiality, integrity, and availability. No vendor patch or advisory details are available at this time.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary code or manipulate application behavior remotely, resulting in full compromise of the affected system's confidentiality, integrity, and availability. This poses a critical risk to systems running vulnerable versions of flowcraft Advanced Personalization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network access to the affected application and monitoring for suspicious activity related to deserialization attempts. Avoid processing untrusted serialized data if possible.