Microsoft Fixes Critical Vulnerability in Entra ID Platform

Microsoft's Entra ID identity platform has been patched to fix a critical vulnerability that could have allowed hackers to remotely run code without user interaction. The flaw, tracked as CVE-2026-69836, was rated with a CVSS score of 10.0, the highest possible rating.

The vulnerability affects Microsoft's cloud-based identity and access management service formerly known as Azure Active Directory. It can be exploited over a network with low attack complexity, requiring no privileges or user interaction.

Microsoft says it identified and fixed the issue before publishing the CVE, releasing CVE-2026-69836 for greater transparency. The company states that there are no additional actions customers need to take.