Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker who can authenticate to the server to elevate privileges locally, potentially giving them full control over the Exchange environment. This flaw is a classic instance of unsafe deserialization (CWE-502) and can lead to unauthorized access to protected messaging data and configuration settings.

The vulnerability affects Microsoft Exchange Server 2016 (Cumulative Update 23), Microsoft Exchange Server 2019 (Cumulative Update 14), and Microsoft Exchange Server Subscription Edition RTM.

The CVSS score of 7.8 indicates a high severity vulnerability. The EPSS score is 2%, indicating a low but nonzero probability of exploitation. The KEV status is not listed, suggesting no confirmed exploitation yet, but the flaw remains high risk for organizations that have not applied the latest cumulative updates. An attacker would likely need legitimate credentials or local system access, so the primary attack vector is local, authenticated.