Apache Kylin CVE-2026-64610

Exploitation requires that the external cache service Apache Kylin is configured to use is itself malicious, compromised, or network-spoofable - the advisory ties the unsafe Java deserialization specifically to a 'broken external cache service,' so an attacker must be able to control the data returned from that cache backend. This is the key limiting factor: a correctly isolated, trusted, and authenticated cache deployment is not directly exploitable by an external actor, and the attack depends on Kylin being configured with an external cache rather than running in a default/standalone mode. Affected versions are Apache Kylin 4 through 5.0.4; authentication requirements against Kylin itself cannot be confirmed because no CVSS vector was provided.

No CVSS vector or score was supplied by the source (CVSS: N/A), and there is no EPSS probability, no CISA KEV listing, and no evidence of public exploit code - so every exploitation-likelihood signal is absent and risk must be inferred from the description and CWE-502 (Deserialization of Untrusted Data). The vulnerability is a genuinely high-impact bug class (unsafe Java deserialization typically yields remote code execution), but the description materially constrains it: the untrusted data flows from a 'broken external cache service,' meaning exploitation presupposes that the external cache backend Kylin relies on is already malicious, compromised, or spoofable. This is therefore a conditional, trust-boundary-dependent flaw rather than a directly internet-exposed unauthenticated RCE, which lowers real-world priority relative to its theoretical severity. In the absence of KEV/EPSS/POC data, treat this as a patch-soon-but-not-emergency issue for organizations actually running Apache Kylin; the dominant uncertainty is the exact exploitation path, since no authoritative CVSS vector exists to confirm attack vector, complexity, or privilege requirements - these should be verified against the Apache advisory.

An attacker who can compromise, spoof, or man-in-the-middle the external cache service that Apache Kylin uses (for example by gaining a foothold on the cache host or intercepting its traffic) returns a malicious serialized Java payload in a cache response. When Kylin (version 4 through 5.0.4) deserializes that attacker-controlled data, the gadget chain executes, likely resulting in code execution in the Kylin process. No public exploit code has been identified at time of analysis.