Deserialization
The latest Deserialization coverage — news, analysis, and updates from the WindowsNews.AI desk.
Unverified Deserialization Flaw in Microsoft HPC Pack Could Enable Remote Code Execution
Microsoft’s High Performance Compute (HPC) Pack is under scrutiny after a report surfaced describing a critical deserialization vulnerability that could allow attackers to execute arbitrary code...
Unauthenticated RCE Exploits Hit On-Prem SharePoint — Patch, Rotate Keys, and Hunt Now
Microsoft’s on-premises SharePoint servers are under active attack from a chain of vulnerabilities that grant unauthenticated attackers remote code execution (RCE). The exploit combines an...
CISA Exposes Critical Hard-Coded Credentials in SunPower Solar Gear, Plus Flaws in Delta, Fuji, Hitachi ICS Software
Four new Industrial Control Systems (ICS) advisories from the Cybersecurity and Infrastructure Security Agency (CISA) on September 2, 2025, highlight severe vulnerabilities in energy and...
Fuji Electric FRENIC-Loader 4 Flaw Opens Engineering Workstations to File-Based Code Execution Attacks
A critical deserialization vulnerability in Fuji Electric’s FRENIC-Loader 4 utility can give attackers full arbitrary code execution on industrial engineering workstations when a user opens a...
CISA Flags Urgent Patches for Exploited Citrix Session Recording and Git Flaws
The Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on August 25, 2025, signaling active exploitation of flaws...
Siemens Admits No Fix Planned for Critical PLCSIM Vulnerability as TIA Portal Flaw Scores 8.5 CVSS
Siemens has disclosed a high-severity deserialization vulnerability in its TIA Portal engineering platform that carries a CVSS v4 score of 8.5, and in a troubling admission, says no fix is planned...
Siemens Engineering Software Hit by CVE-2024-54678: Local Code Execution Risk via IPC Flaw
Industrial control system operators are scrambling to assess their exposure after Siemens disclosed a critical deserialization flaw, tracked as CVE-2024-54678, that affects a broad range of its...
CISA Flags Actively Exploited N-central Flaws: Patch Desert Leaves MSPs Exposed
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities in N-able’s N-central remote monitoring and management platform to its Known Exploited...
Active SharePoint RCE Exploits Chain Deserialization Bug to Deploy Web Shells and Ransomware
Attackers are actively chaining a deserialization vulnerability in on-premises SharePoint Server with an authentication bypass to gain remote code execution without credentials—then stealing the...
Microsoft Patches Critical RCE Flaw in IIS Web Deploy – CVE-2025-53772 Threatens Exposed Servers
Microsoft has issued a high-priority security advisory for a deserialization vulnerability in its Web Deploy tool that could give authenticated attackers the ability to execute arbitrary code on...
SharePoint 'ToolShell' Zero-Day Exploited: Critical RCE Patched Amid Active Attacks
Microsoft has released an emergency security update to patch a critical remote code execution (RCE) vulnerability in SharePoint Server that has been actively exploited in the wild. Tracked as...
CISA August 2025 Advisory Exposes Critical Flaw in Rail Brake Protocol, Demands Broad ICS Patching
The U.S. rail industry faces a safety-critical vulnerability that cannot be fixed with a simple software update. A flaw in the remote linking protocol used by End-of-Train (EoT) and Head-of-Train...