Microsoft Fixes 'Perfect 10' Exploit That Could Have Let Hackers Run Code Remotely

In brief
- Microsoft disclosed a critical remote code execution vulnerability affecting its Entra ID cloud identity service.
- CVE-2026-69836 received a CVSS score of 10.0 and requires no existing privileges or user interaction to exploit.
- Microsoft said it fixed the vulnerability and confirmed it was not exploited in the wild.
Microsoft disclosed a critical vulnerability in its Entra ID identity platform that could allow an unauthorized attacker to remotely execute code without existing privileges or user interaction.
Tracked as CVE-2026-69836, the vulnerability received a CVSS score of 10.0, the highest possible rating. The flaw affects Microsoft Entra ID, the company's cloud-based identity and access management service formerly known as Azure Active Directory.
Microsoft's security advisory says the vulnerability can be exploited over a network with low attack complexity and requires no privileges or user interaction.
Deserialization converts data into a format an application can use. If the application does not properly validate that data, an attacker could manipulate it to execute malicious code.
Microsoft said it identified and fixed the vulnerability before publishing the CVE.
“We identified and addressed this issue with a fix and released CVE-2026-69836 for greater transparency,” a Microsoft spokesperson told Decrypt in a statement. “There are no additional actions customers need to take.”
Microsoft said researchers later corrected the vulnerability's exploitation status from “Yes” to “No,” confirming it was not exploited in the wild and calling the revision an “informational change only.” The company says the flaw was not publicly disclosed, and exploitation is “less likely.”
Artificial intelligence has played an increasing role in finding security vulnerabilities, with researchers and tech companies using AI systems to identify flaws that might otherwise go undetected.
In May, a security researcher using Anthropic's Claude Opus 4.8 discovered a four-year-old vulnerability in Zcash's Orchard privacy pool that could have allowed an attacker to create counterfeit ZEC.
Microsoft has also been developing AI tools for vulnerability discovery. In July, the company added its MAI-Cyber-1-Flash cybersecurity model to MDASH, a system that uses more than 100 AI agents to find and validate software vulnerabilities.
That same month, Anthropic disclosed that Claude models compromised three companies during internal cybersecurity testing after a configuration error gave the models access to the internet.

Facts Only

A critical remote code execution vulnerability affects Microsoft Entra ID.
The vulnerability is tracked as CVE-2026-69836 and received a CVSS score of 10.0.
The flaw impacts the Microsoft Entra ID identity and access management service.
The exploit requires no existing privileges or user interaction.
Deserialization flaws allow an attacker to manipulate data into executing malicious code if validation is improper.
Microsoft identified and fixed the vulnerability before publishing the CVE.
Researchers later revised exploitation status from "Yes" to "No," confirming no in-the-wild exploitation.

Executive Summary

Microsoft disclosed a critical vulnerability, tracked as CVE-2026-69836, affecting its Entra ID cloud identity service. The flaw allows for remote code execution without requiring existing privileges or user interaction, and it was rated with a CVSS score of 10.0. Microsoft confirmed that the vulnerability has been fixed and stated that it was not exploited in the wild. The root cause stems from improper deserialization where data validation was insufficient, potentially allowing an attacker to manipulate data into executing malicious code.

Full Take

The narrative involves a high-severity technical disclosure paired with a simultaneous discussion of evolving security practices, specifically the role of Artificial Intelligence in vulnerability discovery and exploitation risk assessment. The presence of an unexploited zero-day (or near zero-day) with a perfect CVSS score indicates a systemic failure in automated defensive layers or patching processes across large enterprise systems. The transition from a confirmed exploit status to "No" suggests an internal verification process that either caught the incident quickly or that external reporting was corrected, introducing a layer of uncertainty about the full scope of initial exposure. Furthermore, the context provided on AI vulnerability research—where models can discover flaws and have demonstrated security compromises themselves—forces a consideration of the asymmetry between discovering vulnerabilities and mitigating them. This dynamic suggests a future where automated discovery tools, fueled by advanced models, might accelerate both the rate of flaw identification and the sophistication of attack patterns, demanding that resilience strategies shift from reactive patching to proactive architectural assurance against AI-augmented threats.

Sentinel — Human

Confidence

The text appears to be a synthesized journalistic piece that accurately reports on disclosed security events while contextualizing them within the evolving landscape of AI-assisted vulnerability research.

Signals Detected

Sentence length variance is uneven, mixing technical disclosures with narrative flow.

The text moves logically from a specific vulnerability disclosure to broader AI security context without adopting an overly sterile tone.

The transition between the Microsoft incident and the general AI/vulnerability discovery context feels driven by topic relevance rather than rigid template matching.

Specific references (CVE numbers, company names, specific models) appear grounded in documented public disclosures, suggesting factual grounding rather than pure invention.

Human Indicators

The use of direct quotes from a spokesperson and the inclusion of detailed, multi-layered context (vulnerability details + AI security examples) suggest an editorial layering process.

The flow successfully pivots between a specific technical event (Microsoft fix) and broader industry trends (AI vulnerability discovery).