Microsoft Fixes 'Perfect 10' Exploit That Could Have Let Hackers Run Code Remotely

In brief

• Microsoft disclosed a critical remote code execution vulnerability affecting its Entra ID cloud identity service.
• CVE-2026-69836 received a CVSS score of 10.0 and requires no existing privileges or user interaction to exploit.
• Microsoft said it fixed the vulnerability and confirmed it was not exploited in the wild.

Microsoft disclosed a critical vulnerability in its Entra ID identity platform that could allow an unauthorized attacker to remotely execute code without existing privileges or user interaction.

Tracked as CVE-2026-69836, the vulnerability received a CVSS score of 10.0, the highest possible rating. The flaw affects Microsoft Entra ID, the company's cloud-based identity and access management service formerly known as Azure Active Directory.

Microsoft's security advisory says the vulnerability can be exploited over a network with low attack complexity and requires no privileges or user interaction.

Deserialization converts data into a format an application can use. If the application does not properly validate that data, an attacker could manipulate it to execute malicious code.

Microsoft said it identified and fixed the vulnerability before publishing the CVE.

“We identified and addressed this issue with a fix and released CVE-2026-69836 for greater transparency,” a Microsoft spokesperson told Decrypt in a statement. “There are no additional actions customers need to take.”