Critical flaw in Entra ID: Microsoft closes most dangerous vulnerability with maximum CVSS rating
Microsoft has completed work on fixing a critical vulnerability in the Entra ID cloud identity and access management service. This concerns the CVE-2026-69836 flaw, which received the highest possible score on the CVSS scale — 10.0 points. This is an extremely rare case where a vulnerability is recognized as absolutely critical, without any caveats or mitigating factors.
The essence of the problem was the ability to remotely execute arbitrary code. An attacker with no authorization in the system could exploit this flaw without a single action from the victim. In essence, this is a classic "zero-click" attack that requires neither clicking on links nor opening malicious files — only network access.
Given that Entra ID (formerly known as Azure Active Directory) is fundamental infrastructure for authenticating thousands of enterprise customers worldwide, the potential damage from such a vulnerability is hard to overstate. Compromising this service could have opened a direct path for attackers to credentials, access tokens, and internal resources of entire organizations.
At this point, Microsoft has not disclosed details of the attack vector, which is quite understandable — publishing technical specifics before a significant portion of users installs updates would only increase the risks. However, the very fact of assigning the maximum CVSS score indicates that the issue was extremely serious and required immediate response.
Administrators and information security professionals using Entra ID are strongly advised to check the status of update deployment in their tenants. Even though Microsoft has already released a patch, delaying its installation may leave an organization vulnerable to potential attacks that, as practice shows, begin actively exploiting fresh flaws within days of information disclosure.
My comment: This event is yet another reminder that even the largest cloud platforms are not immune to fundamental errors in code. For businesses, this is a signal that reliance on a single identity provider is a risk worth diversifying. Local backup authentication mechanisms and multi-factor protection should become the standard, not an option.