Critical Microsoft Cloud Vulnerability Discovered in Entra ID Service

Microsoft has disclosed a critical Remote Code Execution (RCE) vulnerability in its Entra ID service, previously known as Azure Active Directory. The vulnerability, CVE-2026-69836, affects a hosted cloud service and does not require customer-side patching.

The issue arises from the deserialization of untrusted data, which can lead to unexpected object behavior, unauthorized service activity, or code execution. Microsoft has not publicly disclosed the vulnerable endpoint, backend component, serialization format, payload structure, or execution mechanism.

Although there is no confirmed exploitation for CVE-2026-69836, security teams are advised to review identity and application changes, check sign-in and privileged activity, and preserve Entra logs. Customers should also confirm Microsoft's service-side mitigation and monitor administrative changes.