A critical remote code execution (RCE) vulnerability, **CVE-2026-69836**, with a CVSS score of 10.0, has been addressed in **Microsoft Entra ID**. The cloud-based identity and access management service, previously known as **Azure Active Directory** (**Azure AD**), was susceptible to this flaw. Initially, **Microsoft**'s security bulletin indicated active exploitation of the vulnerability. However, following inquiries, the company updated its assessment, confirming that **CVE-2026-69836** was not exploited in the wild. "Deserialization of untrusted data in **Microsoft Entra ID** allows an unauthorized attacker to execute code over a network," **Microsoft** stated in its alert. Such deserialization flaws occur when applications improperly convert user-controlled data into active objects or code structures without adequate validation. This can lead to severe consequences, including arbitrary code execution, denial-of-service, or unauthorized access. **Microsoft** has credited Principal Security Engineer **Robert Fitzpatrick** for discovering and reporting the issue. Crucially, **Microsoft** emphasizes that the vulnerability has been fully mitigated, and no customer action is required. "There are no additional actions customers need to take," a spokesperson confirmed. This incident follows another recent patch for a high-severity privilege escalation flaw (**CVE-2026-68820**) in the **Windows Ancillary Function Driver for WinSock**. That vulnerability was exploited as a zero-day by the North Korea-linked **Lazarus Group** in their **Operation Dream Job** campaign.