Microsoft Patches a Perfect 10 Entra ID Flaw That Was Already Being Exploited

[James78]

Microsoft has confirmed active exploitation of a maximum severity vulnerability in Entra ID, its cloud based identity platform that used to be called Azure Active Directory. Tracked as CVE-2026-69836, the flaw carries the highest possible CVSS score of 10.0 and stems from a deserialization of untrusted data issue, meaning Entra ID's backend was processing specially crafted data objects without properly validating them first.

The scary part is what this actually enables. An unauthenticated attacker could exploit the flaw over a network to execute arbitrary code, without needing any prior access, any stolen credentials, or any user interaction whatsoever. Given that Entra ID sits at the center of authentication for Microsoft 365, Azure, and a huge number of third party applications, a flaw like this is about as close to a worst case scenario as identity infrastructure gets.

Microsoft says the vulnerability has already been fully mitigated on its own infrastructure and that no customer action is required, which is genuinely good news for anyone relying on the service, but the company has not released details on when exploitation actually began, who was behind it, which organizations were targeted, or how the attack chain worked in practice. That silence is fairly typical for Microsoft's disclosure style, but it does leave defenders with very little to actually hunt for in their own logs.

This is not the first time Entra ID's core has had a brutal year. Back in September 2025 a different critical privilege escalation flaw let a security researcher demonstrate complete access to every single Microsoft Entra ID tenant in the world, and Microsoft patched four other maximum severity vulnerabilities across Azure Arc, Exchange Online, and Azure Managed Instances for Apache Cassandra on the very same day as this latest disclosure.

When the identity layer itself keeps producing perfect 10 vulnerabilities at this pace, it is a genuinely uncomfortable reminder of how much of the modern internet quietly rests on one company's authentication service holding up

Microsoft sounds alarm as perfect-10 Entra ID flaw comes under attackwww.theregister.com

[Bayley_Contender]

A perfect 10 severity score combined with zero authentication and zero user interaction required is about as bad as a vulnerability disclosure gets in this entire industry. The fact that it was already being exploited before Microsoft even patched it makes the whole thing genuinely alarming rather than just theoretical.

[Aaron]

Microsoft's pattern of saying it is fully mitigated, no action needed, while refusing to share any technical detail about the actual exploitation is honestly maddening for defenders trying to figure out if they were already compromised before the fix landed. Trust us just is not a great incident response policy from a company this size.

[SpinorWave]

Five maximum severity vulnerabilities patched on the exact same day across completely different services is either an unbelievable coincidence or a sign Microsoft had a genuinely rough internal security review cycle that finally surfaced all at once.
Either way that is a lot of critical exposure landing in a single 24 hour window.

[Wardlow]

Centralizing identity for basically the entire internet's business software in one single company's platform was always going to produce this exact failure mode eventually. Convenience and single sign on everywhere comes with the tradeoff that one bad deserialization bug becomes a planet scale problem overnight

[CyberRider56]

Genuinely curious how many organizations actually have the logging and monitoring in place to even detect exploitation of a flaw like this after the fact, given how little technical detail Microsoft has shared about what the attack actually looked like on the wire

[Sequence19]

The deserialization of untrusted data root cause is such a classic, well understood vulnerability class at this point that it is honestly surprising to see it show up in a system this critical and this heavily audited. Feels like the kind of thing a security review specifically targeting Entra ID's core should have caught long before an outside attacker did