Critical Entra ID Vulnerability (CVSS 10.0): Remote Code Execution Already Exploited

On Thursday, Microsoft warned of a critical vulnerability in Entra ID, its cloud-based identity and access management service — formerly known as Azure Active Directory (Azure AD). The flaw received the highest possible severity rating: CVSS 10.0.

The vulnerability, tracked as CVE-2026-69836, is a remote code execution issue. In Microsoft's wording, it involves the “deserialization of untrusted data,” which allows an unauthorized attacker to execute code over a network. Bugs of this kind arise when an application converts user-controlled data back into an active object or code structure without proper validation. The consequences can vary — from arbitrary code execution to denial of service and access-control bypass, opening the door to unauthorized actions.

According to the company, the vulnerability has already been exploited in the wild. That said, as of publication there are no details about exactly how the attacks were carried out, when they began, whether they are still ongoing, or how the flaw was discovered. Credit for identifying it and reporting it to the developers has been attributed to principal security engineer Robert Fitzpatrick.

Microsoft separately emphasizes that the problem has already been fully remediated on the service side and that users need not take any action. This makes sense for a cloud service — the fix is deployed centrally, with no need to install updates manually.

As a reminder, earlier this month Redmond closed another notable vulnerability — a privilege escalation flaw in the Windows Ancillary Function Driver for WinSock (CVE-2026-68820, CVSS 7.0). It was exploited as a zero-day: the attacks were carried out by the North Korea-linked group Lazarus as part of a long-running campaign called Operation Dream Job.

Source: The Hacker News