Microsoft patches critical Entra ID remote code execution vulnerability

Microsoft has released 22 security updates to address several severe vulnerabilities, most notably a critical remote code execution (RCE) flaw in Entra ID, tracked as CVE-2026-69836. The Entra ID vulnerability, which carries a maximum CVSS score of 10.0, originated from the deserialization of untrusted data. Because Entra ID serves as the identity backbone for Microsoft 365 and Azure, the flaw posed a significant risk to enterprise logins.

While initial reports suggested the flaw might have been exploited, Microsoft clarified that the issue was discovered internally and patched on the server side. Consequently, no action is required from customers to mitigate this specific threat.

In addition to the Entra ID fix, the security rollout addresses multiple other high-severity and critical vulnerabilities across the Microsoft ecosystem. These include elevation-of-privilege bugs in Azure SQL Database, Azure Arc, and Exchange Online, as well as an RCE flaw in Azure Managed Instance for Apache Cassandra. Most of these mitigations have been deployed by Microsoft on the server side, requiring no manual intervention from users.