Microsoft Entra ID Exploited in Wild: Critical Security Flaw Discovered

Microsoft's cloud-based identity and access management service, Entra ID, has been found to have a critical security flaw that can allow an unauthorized attacker to execute code over a network. The vulnerability, tracked as CVE-2026-69836 with a CVSS score of 10.0, was discovered by principal security engineer Robert Fitzpatrick. Microsoft noted that the flaw allows for remote code execution and has been exploited in the wild.

The company credited Fitzpatrick for discovering and reporting the issue, which was previously known as Azure Active Directory or Azure AD. As of writing, there is no information on how the vulnerability was exploited or when these efforts began.

Microsoft stated that this vulnerability has already been fully mitigated by the company, and therefore, users of the service do not need to take any action.