Microsoft Fixes Critical Entra ID Vulnerability That Could Have Seized Business Accounts
Microsoft's cloud identity service Entra ID has been patched for a critical remote code execution vulnerability that could have allowed an attacker to seize control of business accounts with no user interaction required.
The flaw, tracked as CVE-2026-69836, carries the highest possible CVSS score of 10.0 and was discovered by Microsoft Principal Security Engineer Robert Fitzpatrick.
Making matters more serious, Entra ID is used by millions of business accounts across various platforms, including Microsoft 365 and Azure.