Updated to add: At the time The Register published this article, Microsoft was telling the public this flaw was being exploited in the wild. It then contacted us after publication to tell us it had "corrected" this CVE’s “Exploited” designation to “No,” saying that (contrary to what it said previously), the flaw was not under attack. Microsoft told us: "This was an informational change only."
Microsoft has fixed a maximum-severity vulnerability in Entra ID.
Tracked as CVE-2026-69836, the vulnerability carries the maximum CVSS score of 10.0 and could allow an unauthenticated attacker to execute code remotely in Microsoft's cloud identity service. Microsoft disclosed the flaw on Thursday.
Entra ID, formerly known as Azure Active Directory, sits at the heart of identity and access management for Microsoft customers, handling authentication and access to cloud applications and other corporate resources.
According to Microsoft, the vulnerability stems from unsafe deserialization, in which software reconstructs data supplied from an untrusted source without adequately validating it. An attacker could exploit the weakness over a network without an account and – crucially – without persuading a user to click, open, or otherwise do anything helpful.
"Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network," Microsoft's advisory says.
There are also no public technical details explaining the attack chain, and Microsoft didn't immediately respond to The Register's questions.
There is, however, one welcome piece of news for administrators: no customer-deployed patch is required.
"This vulnerability has already been fully mitigated by Microsoft," the company said. "There is no action for users of this service to take."
Because Entra ID is a Microsoft-operated cloud service, Redmond could fix the vulnerable infrastructure itself rather than ship an update for customers to install.
The CVSS metrics explain the perfect 10: the flaw is remotely exploitable, has low attack complexity, requires neither privileges nor user interaction, and could have a high impact on confidentiality, integrity, and availability.
Microsoft credited principal security engineer Robert Fitzpatrick with discovering and reporting the vulnerability, although the advisory does not explain how the company detected its exploitation in the wild. ®