The issue is a Direct Request ('Forced Browsing') vulnerability in Apache OFBiz, which could allow attackers to execute arbitrary code on vulnerable Linux and Windows servers. This vulnerability has been actively exploited by hackers, with over 25,000 requests targeting 4,000 unique sites detected by Imperva. The vulnerability allows for unauthenticated remote code execution.