Microsoft Patches Critical Entra ID Vulnerability With CVSS 10.0 Score

Microsoft has patched a critical remote code execution vulnerability in its Entra ID cloud identity service, a flaw so severe it received the maximum possible security score. The company confirmed the vulnerability, tracked as CVE-2026-69836, has been fully mitigated and was not exploited in the wild, despite initial reports suggesting otherwise.

The flaw, discovered by Microsoft Principal Security Engineer Robert Fitzpatrick, carried a Common Vulnerability Scoring System (CVSS) score of 10.0. Entra ID, formerly known as Azure Active Directory, is the backbone identity system for Microsoft 365, Azure, and numerous connected third-party applications. A vulnerability at this severity level in such a foundational service drew immediate attention across the cybersecurity industry.

According to Microsoft's security advisory, the root cause was the deserialization of untrusted data. This process involves converting stored data back into a usable format within an application. If that data is not properly validated, an attacker could manipulate it to smuggle in and execute malicious code. The advisory stated the bug could be triggered over a network with low attack complexity and...