This vulnerability in Apache Commons BeanUtils 1.x (before 1.11.0) and 2.x (before 2.0.0-M2) arises from improper access control (CWE-284). Specifically, attackers can exploit the 'declaredClass' property of Java enum objects by passing crafted property paths to PropertyUtilsBean.getProperty() or getNestedProperty() methods. This improper access allows attackers to reach the class loader, potentially enabling arbitrary code execution. The CVSS v3.1 base score is 8.8, indicating high severity, with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows attackers to execute arbitrary code remotely by accessing the class loader of Java enum objects through improper access control in property path handling. This compromises system confidentiality, integrity, and availability.

A fix is available in Apache Commons BeanUtils versions 1.11.0 and later, and 2.0.0-M2 and later. Users should upgrade to these fixed versions to remediate the vulnerability. Patch status is not explicitly stated in the input, but the affected versions are prior to these releases. No vendor advisory content was provided to confirm patch details; therefore, check the Apache Software Foundation advisory for the latest remediation guidance.