Authenticated code execution via allow-listed deserialization class

Deserialization in Microsoft Exchange Server allows remote authenticated users to execute arbitrary code through PowerShell remoting. The allow-listed MultiValuedProperty class exposes an internal constructor-based deserialization path that accepts attacker-controlled types and values. A valid Exchange account and network access to Exchange PowerShell are required; successful exploitation runs arbitrary commands on the server.