Microsoft's Entra ID Vulnerability Earns Perfect 10.0 Severity Rating
A critical remote code execution vulnerability in Microsoft's Entra ID cloud identity service has been patched by the company, but not before it earned a perfect 10.0 severity rating on the CVSS scale.
The bug, tracked as CVE-2026-69836, allowed an attacker to seize control remotely without any privileges or user interaction, and was discovered by Microsoft Principal Security Engineer Robert Fitzpatrick.
Microsoft says it had already fixed the issue before publishing the advisory and that there is no action for customers to take. The company confirmed that the vulnerability was not exploited in the wild, although an early report suggested otherwise.
The discovery of the flaw comes amid a broader industry shift towards AI-assisted vulnerability hunting, with Microsoft itself using artificial intelligence tools to find and validate software vulnerabilities before they reach a public advisory.