Microsoft warns of max severity Entra ID flaw exploited in attacks

Microsoft patched a maximum-severity deserialization vulnerability in Entra ID (CVE-2026-69836) that allowed unauthenticated attackers to execute code; Microsoft says the issue has been fully mitigated, no user action is required, and exploit code is not yet publicly available. The report also references several other critical Azure/Exchange flaws recently addressed and notes ongoing active exploitation concerns for other Microsoft components.