Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution

Microsoft has disclosed and fixed a critical remote code execution vulnerability in its cloud identity platform, Microsoft Entra ID. Tracked as CVE-2026-69836 with a maximum CVSS score of 10.0, the flaw stems from the deserialization of untrusted data, potentially allowing attackers to execute arbitrary code over the network. While reports confirm the vulnerability is being actively exploited in the wild, Microsoft states that it has fully mitigated the issue on their end and advises customers that no specific action is needed.