A flaw in Microsoft Dataverse enables an attacker with untrusted input to trigger deserialization of data, resulting in the execution of arbitrary code on the target system. The vulnerability is classified as a remote code execution flaw and is rooted in improper handling of serialized input (CWE-502).

Microsoft Dataverse is the sole vendor listed for this issue. No specific product versions are enumerated in the available data, so any deployed Dataverse instance that has not received official updates carries the risk.

The CVSS base score of 9.8 indicates critical severity, and while an EPSS score is not available, the lack of a known mitigation and the knowledge that an unauthorized attacker can trigger code execution over the network imply a high likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the impact magnitude suggests that it could be actively targeted if discovered. Based on the description, it is inferred that the attack vector is remote network‑based, requiring only the ability to send crafted data to Dataverse services.