- Microsoft disclosed a critical remote code execution vulnerability in its Entra ID cloud identity service.
- Tracked as CVE-2026-69836, the flaw earned a perfect CVSS score of 10.0 and requires no privileges or user interaction to exploit.
- The company confirmed it fixed the vulnerability and that it was not exploited in the wild.
Microsoft disclosed a critical vulnerability in its Entra ID identity platform that could allow an unauthorized attacker to remotely execute code without existing privileges or user interaction. Tracked as CVE-2026-69836, the flaw received a CVSS score of 10.0, the highest possible rating.
The vulnerability affects Microsoft Entra ID, the company’s cloud-based identity and access management service formerly known as Azure Active Directory. The security advisory states the flaw can be exploited over a network with low attack complexity and requires no privileges or user interaction. Deserialization converts data into a format an application can use, and if the application does not properly validate that data, an attacker could manipulate it to execute malicious code.
Microsoft said it identified and fixed the vulnerability before publishing the CVE. “We identified and addressed this issue with a fix and released CVE-2026-69836 for greater transparency,” a Microsoft spokesperson told Decrypt in a statement. “There are no additional actions customers need to take.”
The company confirmed the vulnerability was not exploited in the wild, calling the correction an “informational change only.” Microsoft added that the flaw was not publicly disclosed, making exploitation “less likely.” Artificial Intelligence has played an increasing role in finding security vulnerabilities, with researchers using AI systems to identify flaws that might otherwise go undetected. In May, a security researcher using Anthropic’s Claude Opus 4.8 discovered a four-year-old vulnerability in ZCash‘s Orchard privacy pool.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
