Microsoft Fixes 'Excellent 10' Exploit That Might Have Let Hackers Run Code Remotely – Decrypt

Briefly
Microsoft disclosed a essential distant code execution vulnerability affecting its Entra ID cloud identification service.
CVE-2026-69836 acquired a CVSS rating of 10.0 and requires no current privileges or consumer interplay to use.
Microsoft stated it fastened the vulnerability and confirmed it was not exploited within the wild.
Microsoft disclosed a essential vulnerability in its Entra ID identification platform that would permit an unauthorized attacker to remotely execute code with out current privileges or consumer interplay.Tracked as CVE-2026-69836, the vulnerability acquired a CVSS rating of 10.0, the very best doable score. The flaw impacts Microsoft Entra ID, the corporate's cloud-based identification and entry administration service previously often known as Azure Lively Listing.Myriad: When will OpenAI launch GPT-6? Click on to make your prediction.Microsoft's safety advisory says the vulnerability might be exploited over a community with low assault complexity and requires no privileges or consumer interplay.Deserialization converts information right into a format an software can use. If the applying doesn't correctly validate that information, an attacker may manipulate it to execute malicious code.Microsoft stated it recognized and stuck the vulnerability earlier than publishing the CVE.“We recognized and addressed this situation with a repair and launched CVE-2026-69836 for better transparency,” a Microsoft spokesperson informed Decrypt in an announcement. “There are not any further actions clients must take.”Microsoft stated researchers later corrected the vulnerability's exploitation standing from “Sure” to “No,” confirming it was not exploited within the wild and calling the revision an “informational change solely.” The corporate says the flaw was not publicly disclosed, and exploitation is “much less seemingly.”Synthetic intelligence has performed an rising position find safety vulnerabilities, with researchers and tech firms utilizing AI methods to establish flaws that may in any other case go undetected.In Might, a safety researcher utilizing Anthropic's Claude Opus 4.8 found a four-year-old vulnerability in Zcash's Orchard privateness pool that would have allowed an attacker to create counterfeit ZEC.Microsoft has additionally been creating AI instruments for vulnerability discovery. In July, the corporate added its MAI-Cyber-1-Flash cybersecurity mannequin to MDASH, a system that makes use of greater than 100 AI brokers to search out and validate software program vulnerabilities.That very same month, Anthropic disclosed that Claude fashions compromised three firms throughout inner cybersecurity testing after a configuration error gave the fashions entry to the web.Day by day Debrief NewsletterStart every single day with the highest information tales proper now, plus unique options, a podcast, movies and extra.