Microsoft disclosed a critical remote code execution vulnerability in its Entra ID cloud identity service, formerly Azure Active Directory. Tracked as CVE-2026-69836, the flaw received a maximum CVSS score of 10.0 and could be exploited over a network without requiring existing privileges or user interaction. The vulnerability stemmed from improper deserialization validation, potentially allowing unauthorized attackers to execute malicious code. Microsoft confirmed it identified and fixed the issue before publishing the CVE, with no evidence of in-the-wild exploitation. The company stated no additional customer action is required.
Source: Read the original article
