Microsoft's Entra ID Hit by Critical RCE Vulnerability with CVSS Score of 10.0

Microsoft's Entra ID identity backbone was recently hit by a critical remote code execution (RCE) vulnerability, CVE-2026-69836. This flaw has a CVSS score of 10.0, making it the highest possible severity.

The bug involves deserialization of untrusted data and can be exploited by an attacker to achieve RCE at the identity provider level, bypassing traditional controls like conditional access policies and multi-factor authentication.

Initially, Microsoft tagged the vulnerability as 'Exploited: Yes' in its security bulletin, but after being questioned by The Hacker News, they corrected it to 'No' on August 21. This incident highlights the fragility of cloud-native vulnerability disclosure for enterprise identity governance.