A deserialization vulnerability on Apache Tomcat servers is being abused in the wild to completely take over affected endpoints, security researchers are warning.