Microsoft Fixes 'Perfect 10' Exploit That Could Have Let Hackers Run Code Remotely
In brief
- Microsoft disclosed a critical remote code execution vulnerability affecting its Entra ID cloud identity service.
- CVE-2026-69836 received a CVSS score of 10.0 and requires no existing privileges or user interaction to exploit.
- Microsoft said it fixed the vulnerability and confirmed it was not exploited in the wild.
Microsoft disclosed a critical vulnerability in its Entra ID identity platform that could allow an unauthorized attacker to remotely execute code without existing privileges or user interaction.
Tracked as CVE-2026-69836, the vulnerability received a CVSS score of 10.0, the highest possible rating. The flaw affects Microsoft Entra ID, the company's cloud-based identity and access management service formerly known as Azure Active Directory.
Microsoft's security advisory says the vulnerability can be exploited over a network with low attack complexity and requires no privileges or user interaction.
Deserialization converts data into a format an application can use. If the application does not properly validate that data, an attacker could manipulate it to execute malicious code.
Microsoft said it identified and fixed the vulnerability before publishing the CVE.
“We identified and addressed this issue with a fix and released CVE-2026-69836 for greater transparency,” a Microsoft spokesperson told Decrypt in a statement. “There are no additional actions customers need to take.”
Microsoft said researchers later corrected the vulnerability's exploitation status from “Yes” to “No,” confirming it was not exploited in the wild and calling the revision an “informational change only.” The company says the flaw was not publicly disclosed, and exploitation is “less likely.”
Artificial intelligence has played an increasing role in finding security vulnerabilities, with researchers and tech companies using AI systems to identify flaws that might otherwise go undetected.
In May, a security researcher using Anthropic's Claude Opus 4.8 discovered a four-year-old vulnerability in Zcash's Orchard privacy pool that could have allowed an attacker to create counterfeit ZEC.
Microsoft has also been developing AI tools for vulnerability discovery. In July, the company added its MAI-Cyber-1-Flash cybersecurity model to MDASH, a system that uses more than 100 AI agents to find and validate software vulnerabilities.
That same month, Anthropic disclosed that Claude models compromised three companies during internal cybersecurity testing after a configuration error gave the models access to the internet.