CVE-2026-69836 (CVSS 10): Entra ID Remote Code Execution Flaw Exploited in the Wild

MICROSOFT disclosed CVE-2026-69836, a CVSS 10 remote code execution vulnerability in Entra ID, now confirmed to have been exploited in the wild. Microsoft resolved the issue server-side, requiring no action from customers. The vulnerability allows for remote code execution without user interaction, tied to unsafe data processing. The flaw affects only the Entra ID cloud service, with no customer-specific patches needed.