CVE-2026-31072 affects APScheduler's JSONSerializer and CBORSerializer components across all versions, including 3.10.x and 4.0.0a5. The vulnerability is an insecure deserialization flaw (CWE-502) in the unmarshal_object function, which permits an attacker to instantiate arbitrary classes and inject state by dynamically importing modules and calling __setstate__. This enables remote code execution when maliciously crafted JSON or CBOR payloads are processed by the vulnerable serializers. The CVSS score is 9.8 (critical), reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation level is stated in the vendor advisory, and no known exploits in the wild have been reported. The Red Hat advisory is available but does not specify a fix status.

Successful exploitation allows remote attackers to execute arbitrary code on the affected system without authentication or user interaction. This can lead to full system compromise, including unauthorized access, data manipulation, and service disruption. The vulnerability affects all versions of APScheduler's JSONSerializer and CBORSerializer, making any application using these components potentially vulnerable.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-31072 for current remediation guidance. Until an official fix is available, avoid using the vulnerable serializers with untrusted input. Consider disabling or restricting deserialization of untrusted data or applying application-level input validation to mitigate risk.