Robert Fitzpatrick

**Name of the Vulnerable Software and Affected Versions** Microsoft Entra ID (affected versions not specified) **Description** An issue exists in the cloud identity platform where the deserialization of untrusted data allows an unauthorized remote attacker to execute arbitrary code over the network. This flaw requires no authentication and no user interaction. Deserialization is the process of taking data from a wire or storage and rebuilding it into an object in memory; when this process is unsafe, it can be manipulated to run malicious commands. There are conflicting reports regarding real-world exploitation, with some sources stating the issue was exploited in the wild and others indicating Microsoft later corrected this assessment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.