Microsoft Tackles Critical Entra ID Flaw Already Being Exploited by Attackers

Microsoft has addressed a critical vulnerability in its Entra ID service that could have allowed an unauthenticated attacker to execute code remotely. The flaw, tracked as CVE-2026-69836, carries the maximum CVSS score of 10.0 and was already being exploited by attackers.

The vulnerability stems from unsafe deserialization, where software reconstructs data from an untrusted source without proper validation. This weakness allows an attacker to exploit the flaw over a network without requiring user interaction or privileges.

Microsoft has not disclosed who is exploiting the flaw or how widespread the attacks are, but has stated that no customer-deployed patch is required since the vulnerability has been fully mitigated by the company itself.