Microsoft fixes critical Entra ID remote-code-execution flaw

Microsoft disclosed and fixed CVE-2026-69836, a critical remote-code-execution vulnerability in its Entra ID cloud identity service. The flaw received a CVSS score of 10.0 and, according to Microsoft's advisory, could be exploited over a network with low attack complexity without existing privileges or user interaction. Microsoft said it identified and addressed the issue before publishing the CVE, and said the vulnerability was not publicly disclosed or exploited in the wild. The company said customers need take no additional action.