Microsoft has disclosed a critical vulnerability that allows remote code execution in its Entra ID cloud identity service, formerly known as Azure Active Directory, and confirmed that attackers have already exploited it. The vulnerability, designated CVE-2026-69836, has a CVSS severity rating of 10.0. According to Microsoft, the de-serialization of untrusted data in Entra ID allows an unauthorized attacker to execute code across the network. Entra ID serves as the front end for Microsoft 365, Azure, Dynamics CRM Online, and a long list of connected applications. The vulnerability is not related to an update of an individual workstation, but rather to a flaw in the hosted identity layer that verifies logins and enforces policies. Microsoft attributed the discovery of the vulnerability to lead security engineer Robert Fitzpatrick. Technical reports indicate that unauthorized attackers can execute code with low-sophistication attacks, and no publicly available exploit code was available at the time of the warning.