The MuleSoft Mule Community Edition runtime engine before 3.8 allows remote attackers to execute arbitrary code because of Java Deserialization, related to Apache Commons Collections
https://github.com/advisories/GHSA-cvcf-w75c-gw5r
https://threat.tevora.com/mulesoft-3-8-unauthenticated-rce/
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3636
https://docs.mulesoft.com/release-notes/mule-runtime/mule-3.8.0-release-notes