Microsoft Entra ID vulnerability receives maximum CVSS 10.0 rating

Microsoft has disclosed a critical remote code execution (RCE) vulnerability in its Entra ID cloud identity platform, formerly known as Azure Active Directory. The flaw, identified as CVE-2026-69836, has been assigned the maximum CVSS 3.1 severity score of 10.0.

The vulnerability stems from the deserialization of untrusted data, which could allow an unauthorized attacker to execute code over a network without requiring authentication or user interaction. Because Entra ID serves as a central gatekeeper for Microsoft 365, Azure, and various enterprise applications, the potential impact on organizational ecosystems is significant.

Microsoft has already patched the vulnerability on the service side. Since Entra ID is a managed cloud service, users do not need to download or apply manual updates. Microsoft also clarified that there has been no evidence of the flaw being exploited in the wild. While no direct action is required from customers, security professionals are advised to monitor sign-in and audit logs for any suspicious authentication patterns or unauthorized administrative changes.