CVE-2025-53772

CVE-2025-53772 is a deserialization of untrusted data flaw (CWE-502) in Microsoft Web Deploy 4.0 that allows an authorized attacker — one with valid low-privileged credentials — to send crafted serialized data to the Web Deploy service over the network and execute arbitrary code. The attack requires no user interaction (UI:N) and only low privileges (PR:L), so any account that can reach a listening Web Deploy endpoint is a potential trigger. Successful exploitation yields remote code execution with high impact on confidentiality, integrity, and availability, consistent with code running under the Web Deploy service account on the Windows/IIS host. Microsoft Web Deploy 4.0 is the only affected product named in the data, and the vulnerability is not yet listed in CISA's KEV with no public proof-of-concept known, but the 23.9% EPSS score (98th percentile) indicates an elevated likelihood of exploitation within 30 days.

What to do: Apply Microsoft's security update for Web Deploy 4.0 as referenced in the vendor advisory, and verify the installed build via 'msdeploy.exe --version' or the msdepsvc service binary version. Until patched, restrict access to the Web Deploy service (msdepsvc, typically TCP 80) to trusted networks and audit privileged/service accounts that could reach it. Also inventory Windows/IIS servers for Web Deploy 4.0 installations, since the tool is often bundled silently with hosting and deployment tooling.