Authenticated code execution via PowerShell object deserialization

Deserialization in affected Microsoft Exchange Server 2013, 2016, and 2019 builds allows remote authenticated users to execute arbitrary code. SerializationTypeConverter reads SerializationData from a remoted PSObject and passes its bytes to BinaryFormatter; the allowed GenericSidIdentity type reaches a ClaimsIdentity gadget during a second deserialization. Exploitation requires HTTP access to the PowerShell endpoint, a valid Exchange account, Kerberos authentication, and domain-controller reachability; successful exploitation runs attacker-chosen code in the Exchange PowerShell backend.