Microsoft Patches Critical CVE-2026-69836 Vulnerability in Entra ID Cloud Identity Platform

Microsoft has fixed a critical vulnerability in its Entra ID cloud identity platform that could have allowed hackers to remotely execute code without any credentials or user interaction.

The flaw, tracked as CVE-2026-69836, earned a CVSS score of 10.0, the maximum on the industry-standard severity scale. It affects Entra ID, the identity and access management service previously known as Azure Active Directory that serves as the authentication backbone for Microsoft's sprawling enterprise ecosystem.

The vulnerability falls under CWE-502, a classification covering the deserialization of untrusted data. Deserialization is the process of converting data into a format an application can use. When an application fails to properly validate that incoming data, an attacker can manipulate it to execute malicious code.

Microsoft said it identified and patched the issue before publishing the advisory, and stated there is no evidence the vulnerability was ever exploited in the wild.