Microsoft Dataverse
Monthly
Unauthorized remote code execution is possible in Microsoft Dataverse through deserialization of untrusted data, scored 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the vector carries PR:N and UI:N, the vulnerable deserialization path can be reached by remote attackers without authentication, user interaction, or special configuration. No public exploit code has been identified at time of analysis (E:U) and there is no confirmed active exploitation; the principal constraint on real-world risk is that Dataverse is a Microsoft-operated cloud service, so the official fix (RL:O) is applied server-side by Microsoft and exposure is largely bounded to the pre-patch window.
Unauthorized remote code execution is possible in Microsoft Dataverse through deserialization of untrusted data, scored 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the vector carries PR:N and UI:N, the vulnerable deserialization path can be reached by remote attackers without authentication, user interaction, or special configuration. No public exploit code has been identified at time of analysis (E:U) and there is no confirmed active exploitation; the principal constraint on real-world risk is that Dataverse is a Microsoft-operated cloud service, so the official fix (RL:O) is applied server-side by Microsoft and exposure is largely bounded to the pre-patch window.