Microsoft revealed a critical remote-code execution flaw impacting its Entra ID cloud identity service.
The vulnerability, tracked as CVE-2026-69836, earned a maximum CVSS score of 10.0 and can be exploited without any privileges or user interaction.
Microsoft stated that it has patched the flaw and confirmed there is no evidence of active exploitation.
Microsoft disclosed a critical vulnerability in its Entra ID identity platform that could enable an unauthorized attacker to execute code remotely without needing privileges or user interaction.
Identified as CVE-2026-69836, the flaw carries the highest possible CVSS rating of 10.0 and affects Microsoft Entra ID, the cloud-based identity and access management service previously called Azure Active Directory.
Myriad: When will OpenAI release GPT-6? Click to make your prediction.
According to Microsoft’s security advisory, the vulnerability can be exploited over a network with low attack complexity and does not require any privileges or user interaction.
Deserialization transforms data into a usable format for an application. If the application fails to properly validate that data, an attacker could manipulate it to run malicious code.
Microsoft said it identified and patched the vulnerability prior to releasing the CVE.
“We identified and addressed this issue with a fix and released CVE-2026-69836 for greater transparency,” a Microsoft spokesperson told Decrypt. “No further action is required from customers.”
Microsoft noted that researchers later changed the exploitation status from “Yes” to “No,” confirming there was no active exploitation and describing the update as an informational change. The company added that the flaw was never publicly disclosed and that exploitation remains unlikely.
Artificial intelligence is increasingly used to uncover security vulnerabilities, as researchers and technology firms employ AI systems to detect flaws that might otherwise remain hidden.
In May, a security researcher leveraging Anthropic’s Claude Opus 4.8 uncovered a four‑year‑old flaw in Zcash’s Orchard privacy pool that could have enabled an attacker to mint counterfeit ZEC.
Microsoft has also been developing AI‑driven tools for vulnerability discovery. In July, it integrated its MAI‑Cyber‑1‑Flash cybersecurity model into MDASH, a platform that employs over 100 AI agents to identify and validate software vulnerabilities.
That same month, Anthropic revealed that its Claude models inadvertently compromised three companies during internal cybersecurity testing when a configuration error granted the models internet access.
