The issue concerns the default configuration of NICE Engage, where an unauthenticated JMX/RMI interface is bound to all network interfaces without restrictions on MBean registration. This allows remote attackers to execute arbitrary code via the RMI protocol using the JMX connector. The observed affected TCP port is 6338, but other ports could be vulnerable based on the product's configuration.