Microsoft patches perfect-10 Entra ID RCE already exploited in the wild
Microsoft confirms attackers have already weaponized a maximum-severity RCE in Entra ID, the identity backbone behind Microsoft 365 and Azure. CVE-2026-69836 is an unsafe-deserialization flaw that lets an unauthenticated attacker execute code over the network, and Redmond says it is fully mitigated, so no customer action is needed. What it has not said: who is behind the exploits, when they began, or whether they are still ongoing.