Microsoft Entra ID contains a CWE-502 deserialization flaw where untrusted network data is deserialized, enabling an unauthorized remote attacker to execute code. CVSSv3.1 10.0. Affected and fixed versions are not listed; apply Microsoft guidance from MSRC and prioritize patching/mitigations.