IIS WebDeploy RCE Vulnerability Gets Public PoC

A newly disclosed remote code execution (RCE) vulnerability in Microsoft’s IIS Web Deploy toolchain has drawn attention after a public PoC was released. Tracked as CVE-2025-53772, the flaw exists in the unsafe deserialization logic of the msdeployagentservice and msdeploy[.]axd endpoints, enabling authenticated attackers to run arbitrary code on vulnerable web servers.

IIS Web Deploy (msdeploy) is used to package and synchronise web applications, IIS configurations, and related resources across environments, with deployment paths through the Web Management Service (WMSvc) via the /msdeploy[.]axd endpoint and the Web Deploy Agent Service (MsDepSvc).

The vulnerability stems from how HTTP header values are deserialized, specifically the MSDeploy[.]SyncOptions header, which is expected to be a GZip-compressed, Base64-encoded blob; deserialization uses .NET’s BinaryFormatter, allowing an attacker-controlled payload to instantiate objects and invoke commands.

A publicly available GitHub gist demonstrates a minimal C# payload generator that, after serialization, GZip compression and Base64 encoding, is sent in the SyncOptions header to /msdeploy[.]axd; if accepted, the server may execute the embedded command. Attackers with valid credentials can deploy backdoors, pivot to other systems, or exfiltrate data, and according to Microsoft, the advisory urges applying the latest Web Deploy updates urgently.