deserialization vulnerability

Microsoft has patched CVE-2026-50649, a high-severity .NET vulnerability that can allow an attacker to execute code after a victim processes maliciously constructed data. The flaw was disclosed on July 14, 2026, with fixes delivered through .NET 8.0.29, .NET 9.0.18, .NET 10.0.10, updated Visual...

Microsoft released a security update on March 10, 2026 that closes a high‑severity remote code execution (RCE) vulnerability in on‑premises Microsoft SharePoint Server tracked as CVE‑2026‑26114; the flaw is a deserialization of untrusted data issue that could allow an attacker with low...

Microsoft has added CVE‑2026‑25166 to its Security Update Guide for the Windows Assessment and Deployment Kit (ADK), identifying a deserialization flaw in Windows System Image Manager (WSIM) that can lead to remote code execution — in practice, a local attacker with low‑privilege access can...

Microsoft’s public tracking and ecosystem signals identify the remote code execution (RCE) risk in the Azure SDK for Python as CVE‑2026‑21226 — a deserialization vulnerability in the azure‑core shared client library that Microsoft and multiple independent trackers classify as high severity and...