Microsoft warns of max severity Entra ID flaw exploited in attacks

Microsoft discloses maximum severity flaw in Entra ID

The company said the remote-code execution vulnerability has been fully mitigated and no further action is necessary.

Microsoft sounds alarm as perfect-10 Entra ID flaw comes under attack

Microsoft has fixed a maximum-severity vulnerability in Entra ID that attackers were already exploiting in the wild. Tracked as CVE-2026-69836, the vulnerability carries the maximum CVSS score of 10.0 and could allow an unauthenticated attacker to execute code remotely in Microsoft's cloud identity service. Microsoft disclosed the flaw on Thursday, along with the unwelcome news that exploitation had already been detected. Entra ID, formerly know…

Microsoft warns of max severity Entra ID flaw exploited in attacks

Microsoft has patched a maximum-severity vulnerability in the Entra ID identity and access management (IAM) platform that has been exploited in attacks.

Microsoft’s CVSS 10.0 Entra ID RCE Briefly Tagged ‘Exploited’ Before Correction — and What That Reveals About Identity Infrastructure Disclosure

On August 20, 2026, Microsoft disclosed CVE-2026-69836, a critical remote code execution vulnerability in Entra ID. With a CVSS score of 10.0, the flaw represents the highest possible severity: an unauthenticated, network-accessible entry point into the core identity backbone of the Microsoft ecosystem. The vulnerability is categorized under CWE-502, which involves the deserialization of untrusted data — a process where applications convert user…

Microsoft Patches Entra ID RCE Vulnerability Exploited in Attacks

A maximum-severity vulnerability in Microsoft Entra ID allowed unauthenticated attackers to remotely execute code and was exploited in attacks before Microsoft mitigated the flaw. The vulnerability required no existing privileges or user interaction, lowering the barriers to successful exploitation. Microsoft has fully mitigated the issue within its cloud infrastructure and said Entra ID customers do not need to take additional action. “Deserial…

Microsoft Says Latest Entra ID Flaw CVE-2026-69836 Exploited

Microsoft disclosed on Thursday that a maximum-severity remote code execution vulnerability in Entra ID, the identity service underpinning Microsoft 365, Azure and Dynamics 365, was exploited in the wild before the company mitigated it on its own infrastructure. The flaw, tracked as CVE-2026-69836 and rated CVSS 10.0, required no authentication and no user interaction. Entra ID, formerly Azure Active Directory, is the authentication and authoriz…