Microsoft has quietly patched a flaw in Entra ID — its cloud identity platform handling authentication for millions of enterprise users. The vulnerability,
CVE-2026-69836, scored a 10.0 on the CVSS scale: the absolute ceiling. No privileges, no user interaction, exploitable over the network.Classic deserialization: malformed data in, remote code execution out. Except Microsoft found and fixed it before the CVE even went public, according to Decrypt. No exploitation in the wild. Nothing for customers to do.
A perfect 10. Never cashed in. The most anticlimactic heist of the year.