Microsoft has patched a critical remote code execution vulnerability in its identity and access management service Entra ID. Contrary to media reports currently circulating, though, the vulnerability hasn't actually been successfully exploited for attacks.
A status that was initially misreported
Numerous reports about the vulnerability EUVD-2026-63693 / CVE-2026-69836, which carries the maximum CVSS score of 10.0, are currently circulating online. In its security advisory from August 20, 2026, Microsoft initially confirmed that the vulnerability was being actively exploited, but corrected that a day later. The advisory now reads "Exploited No." The vulnerability also isn't listed in CISA's KEV catalog. Should the threat situation change, that will be reported.
A deserialization flaw at maximum severity
The vulnerability is a deserialization flaw. Because Entra ID deserializes untrusted data, unauthorized attackers could execute code over a network. Exploiting it requires low complexity, since neither privileges nor user interaction are needed. That makes the maximum possible CVSS score of 10.0 entirely justified, especially since Entra ID is the central point of access for Microsoft cloud environments and thus forms the trust foundation for every connected service.
Since Entra ID is operated exclusively by Microsoft, the fix was applied server-side, and customers don't need to take any action. Despite the lack of active exploitation, the case shows how quickly a theoretically maximum-critical vulnerability can turn into a supposedly already-exploited threat in media reports, even after the vendor has long since corrected its original assessment.