Microsoft has disclosed a critical remote code execution vulnerability affecting Entra ID, its cloud-based identity and access management service, and confirmed that the flaw has been fixed.

Tracked as CVE-2026-69836, the vulnerability received a CVSS score of 10.0—the highest possible rating. According to Microsoft's security advisory, the flaw could be exploited over a network with low attack complexity and required no privileges and no user interaction, meaning an unauthorized attacker could remotely execute code without any existing access to the target environment.

Entra ID is Microsoft's cloud identity platform, formerly known as Azure Active Directory, and serves as the sign-in and access-control layer for Microsoft 365, Azure, and large numbers of third-party business applications. Because identity platforms sit upstream of the services that trust them, security flaws in systems like Entra ID draw intense scrutiny from enterprise security teams.

The vulnerability stemmed from a deserialization issue. Deserialization is the process of converting data into a format an application can use; if the application does not properly validate that data, an attacker could manipulate it to execute malicious code. Deserialization flaws are a long-recognized class of weakness—cataloged by MITRE as CWE-502—and have repeatedly been leveraged to achieve remote code execution in widely used software.

Microsoft said it identified and fixed the vulnerability before publishing the CVE. Cloud identity platforms have been high-profile targets before: in 2023, attackers used a stolen Microsoft signing key to forge Azure AD tokens—Azure AD being Entra ID's name before the rebrand—to access the email of roughly 25 organizations, including U.S. government agencies. That breach was followed by Microsoft's launch of its Secure Future Initiative, a company-wide effort to harden its products and engineering practices.

"We identified and addressed this issue with a fix and released CVE-2026-69836 for greater transparency," a Microsoft spokesperson told Decrypt in a statement. "There are no additional actions customers need to take." Because Entra ID runs as a managed cloud service rather than software customers install and maintain themselves, the fix was deployed on Microsoft's infrastructure—no customer-side patching was required.

Researchers later corrected the vulnerability's exploitation status from "Yes" to "No," confirming that it was not exploited in the wild—a revision Microsoft described as an "informational change only." The company said the flaw was not publicly disclosed and assessed exploitation as "less likely."

The disclosure comes as artificial intelligence plays an increasing role in finding security vulnerabilities, with researchers and technology companies using AI systems to identify flaws that might otherwise go undetected.

In May, a security researcher using Anthropic's Claude Opus 4.8 discovered a four-year-old vulnerability in Zcash's Orchard privacy pool that could have allowed an attacker to create counterfeit ZEC.

Microsoft has also been developing AI tools for vulnerability discovery. In July, the company added its MAI-Cyber-1-Flash cybersecurity model to MDASH, a system that uses more than 100 AI agents to find and validate software vulnerabilities.

That same month, Anthropic disclosed that Claude models had compromised three companies during internal cybersecurity testing after a configuration error gave the models access to the internet.