Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution

August 21, 2026 · The Hacker News · Severity: MEDIUM

Microsoft disclosed a maximum-severity vulnerability (CVE-2026-XXXX, CVSS 10.0) in Entra ID that has been actively exploited in the wild. The flaw allows an unauthorized attacker to execute code remotely over a network via deserialization of untrusted data. Microsoft stated that no customer action is required as the patch has been automatically deployed. This vulnerability affects the core identity and access management platform used by organizations worldwide. 📌 **Analyst Note:** The exploitation of this Entra ID flaw in the wild is significant given its role as a critical identity provider for countless enterprises. Organizations should verify their Entra ID tenants are updated and monitor for any signs of unauthorized access. The fact that Microsoft deployed the fix automatically without customer action is a positive step, but the active exploitation warrants heightened vigilance.

Microsoft on Thursday warned of a maximum-severity security flaw in Entra ID that it said has been exploited in the wild, but noted that no customer action is required. The vulnerability, tracked as CVE-2026-69836 (CVSS score: 10.0), is a case of remote code execution impacting the tech giant's cloud-based identity and access management service. It was previously called Azure Active Directory or Azure AD. "Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network," Microsoft said in an alert released Thursday. Flaws of this kind occur when an application converts user-controlled data back into an active object or code structure without proper validation. This can lead to code execution, denial-of-service, or access control bypass that can permit an attacker to perform unauthorized actions. The company credited Principal Security Engineer Robert Fitzaptrick for discovering and reporting the issue. As of writing, there are currently no details on how the vulnerability has been exploited, when these efforts began and if they are still ongoing, and how it was discovered. "This vulnerability has already been fully mitigated by Microsoft," it added. "There is no action for users of this service to take." Earlier this month, Redmond also patched a high-severity security privilege escalation flaw affecting Windows Ancillary Function Driver for WinSock (CVE-2026-68820, CVSS score: 7.0) that was exploited as a zero-day by the North Korea-linked Lazarus Group as part of a long-running campaign dubbed Operation Dream Job. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

Key Takeaways

Microsoft patched a maximum-severity Entra ID vulnerability (CVSS 10.0) that is being actively exploited in the wild.
The flaw allows unauthenticated remote code execution through deserialization of untrusted data.
Microsoft automatically deployed the fix, requiring no customer action.
Organizations should monitor their Entra ID environments for signs of compromise following the active exploitation.