Microsoft sounds alarm as perfect-10 Entra ID flaw comes under attack
Redmond says the cloud identity bug is already fixed, but isn't saying who exploited it or how widely
Microsoft has fixed a maximum-severity vulnerability in Entra ID that attackers were already exploiting in the wild.
Tracked as CVE-2026-69836, the vulnerability carries the maximum CVSS score of 10.0 and could allow an unauthenticated attacker to execute code remotely in Microsoft's cloud identity service. Microsoft disclosed the flaw on Thursday, along with the unwelcome news that exploitation had already been detected.
Entra ID, formerly known as Azure Active Directory, sits at the heart of identity and access management for Microsoft customers, handling authentication and access to cloud applications and other corporate resources.
According to Microsoft, the vulnerability stems from unsafe deserialization, in which software reconstructs data supplied from an untrusted source without adequately validating it. An attacker could exploit the weakness over a network without an account and – crucially –...
Copyright of this story solely belongs to theregister.com. To see the full text click HERE
