This vulnerability is a PHP Object Injection issue classified under CWE-502, affecting Eli Scheetz Anti-Malware Security and Brute-Force Firewall versions up to 4.23.87. It allows an attacker with low privileges and no user interaction to execute arbitrary code or manipulate application state by deserializing untrusted data. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch is currently available, and the product is not a cloud service.

Successful exploitation could lead to complete compromise of the affected system, including unauthorized disclosure, modification, or destruction of data, and disruption of service. The vulnerability allows remote attackers with low privileges to execute arbitrary code without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected application and monitoring for suspicious activity related to deserialization processes. Avoid processing untrusted serialized data where possible.