Critical vulnerability in IIS Web Deploy: PoC exploit is now public

This week, a proof-of-concept exploit was published for CVE-2025-53772, a critical remote code execution vulnerability in Microsoft’s IIS Web Deploy (msdeploy) tool, which has raised urgent alarms in the .NET and DevOps communities.

CVE-2025-53772 is a critical RCE vulnerability in the msdeploy.axd and msdeployagentservice endpoints of Microsoft Web Deploy, caused by insecure deserialization of HTTP header data in GZip + Base64 format. Allows an authenticated attacker to remote code execution.

Microsoft has assigned a CVSS score of 8.8 for CVE-2025-53772. Immediate mitigations include disabling the Web Deploy Agent (MsDepSvc) service, applying strict network ACLs on the msdeploy.axd endpoint, and applying inbound filters to block unexpected MSDeploy.SyncOptions headers.

IIS Web Deploy (msdeploy) is a set of tools that packages and moves web applications, IIS configurations, and provider-based resources to a target environment. It supports two types of access mechanisms: via the Web Management Service (WMSvc) on HTTP(S) endpoints: /msdeploy.axd via the Web Deploy Agent Service (MsDepSvc): msdeployagentservice

Key features include: Provider-based synchronization and deployment for files, websites, certificates, databases, etc. Packaging ( GetPackage) and Package Applying ( Sync) Workflows This high flexibility, when combined with serialization designs that do not rigorously validate inputs, expands the attack surface.

A long-term fix requires replacing BinaryFormatter with a secure serializer (for example, DataContractSerializer with explicit type contracts) and validating all header inputs before deserialization.

With the rise of PoC exploits, organizations leveraging IIS Web Deploy should prioritize patching and hardening to prevent authenticated attackers from exploiting this RCE vector. critical.

Follow us on Google News to receive daily updates on cybersecurity. Contact us if you would like to report news, insights or content for publication.

Agostino Pellegrino

He is a freelancer, teacher and expert in Computer Forensics, Cyber Security and Ethical Hacking and Network Management. He has collaborated with leading educational institutions internationally and has practiced teaching and mentorship in advanced Offensive Security techniques for NATO obtaining major awards from the U.S. Government. His motto is "Study. Always."

Areas of Expertise: Cybersecurity architecture, Threat intelligence, Digital forensics, Offensive security, Incident response & SOAR, Malware analysis, Compliance & frameworks