Microsoft IIS Web Deploy Vulnerability Allows Remote Code Execution

Microsoft has disclosed a critical security vulnerability in its Internet Information Services (IIS) Web Deploy tool that could allow attackers to execute arbitrary code remotely on affected systems.

The vulnerability, designated as CVE-2025-53772, was announced on August 12, 2025, and carries an “Important” severity rating with a CVSS score of 8.8 out of 10.

The vulnerability stems from improper deserialization of untrusted data within the Web Deploy framework, a Microsoft tool commonly used for deploying web applications and content to IIS web servers.

This flaw allows authenticated attackers with low-level privileges to potentially gain complete control over vulnerable systems by exploiting the deserialization process.

The attack vector is particularly concerning as it can be executed ...