Microsoft Fixes 'Perfect 10' Exploit in Entra ID Platform

Microsoft has patched a 'Perfect 10' exploit in its Entra ID identity platform that could have allowed hackers to run code remotely without user interaction. The vulnerability, tracked as CVE-2026-69836, received a CVSS score of 10.0, the highest possible rating.

The flaw affects Microsoft's cloud-based identity and access management service formerly known as Azure Active Directory. According to Microsoft's security advisory, an attacker could manipulate data deserialization to execute malicious code without proper validation.

Microsoft identified and fixed the vulnerability before publishing the CVE, stating it was not exploited in the wild. Researchers later corrected the exploitation status from 'Yes' to 'No', confirming the revision was only informational.