Microsoft says Entra ID code-execution flaw was exploited and mitigated

Microsoft warned of CVE-2026-69836, a maximum-severity remote-code-execution vulnerability in its Entra ID cloud identity and access-management service, according to an alert cited by The Hacker News. Microsoft said deserialization of untrusted data could let an unauthorized attacker execute code over a network and said the flaw had been exploited in the wild. The company also said it had fully mitigated the issue and that customers need take no action. The report gives no details on the exploitation activity.