An unauthenticated attacker with network access to the JBOSS EAP/AS versions 6.x and below Remoting Unified Invoker interface can send a serialized object to the interface to execute code on vulnerable hosts.
4bfb5f55643ee08ae8c9999d9fa55d6d1af99c180f30e402f0089770ca5d6712