Microsoft Confirms Maximum-Severity Entra ID Vulnerability Exploited In Attacks

Microsoft has disclosed a maximum-severity security vulnerability in Microsoft Entra ID that was exploited in real-world attacks before the company completed a cloud-side fix, raising significant questions about the exposure of one of the most consequential identity platforms used by businesses, governments, and public-sector organizations worldwide.

The vulnerability, tracked as CVE-2026-69836, carries a CVSS severity score of 10.0 and could allow an unauthorized attacker to execute code remotely over a network. Microsoft attributed the issue to the deserialization of untrusted data, a class of software weakness that can enable maliciously crafted input to manipulate an application’s execution.