The vulnerability arises from deserialization of untrusted data in Azure Service Bus, permitting an authorized attacker to execute arbitrary code over the network. This flaw is a classic case of uncontrolled deserialization (CWE-502) and enables remote code execution, potentially leading to full compromise of the service bus infrastructure and any downstream consumers.

Affected systems are Microsoft Azure Service Bus services. No specific product version information is provided in the CVE data, so all current deployments of Azure Service Bus may be susceptible unless a patch has been applied.

The CVSS score of 9.9 indicates critical severity. Because the EPSS score is not available and the vulnerability is not listed in KEV, the exploitation likelihood is unclear, but the flaw requires an attacker with legitimate access to the Service Bus namespace to craft and send malicious serialized payloads, which could occur if permissions are overly permissive. Attackers can gain remote code execution by exploiting this deserialization flaw, allowing them to run arbitrary code on the Service Bus host or downstream consumers.