Anthropic · Microsoft · Claude · Decrypt
Microsoft Patches 'Perfect 10' Exploit That Could Have Let Hackers Run Code Remotely
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
★ Tier-1 Source
Microsoft disclosed a critical vulnerability in its Entra ID identity platform that could allow an unauthorized attacker to remotely execute code without existing privileges or user interaction.
Key facts
- Tracked as CVE-2026-69836, the vulnerability received a CVSS score of 10.0, the highest possible rating
- We identified and addressed this issue with a fix and released CVE-2026-69836 for greater transparency,” a Microsoft spokesperson told Decrypt in a statement
- In May, a security researcher using Anthropic's Claude Opus 4.8 discovered a four-year-old vulnerability in Zcash's Orchard privacy pool that could have allowed an attacker to create counterfeit ZEC
- Microsoft said it identified and fixed the vulnerability before publishing the CVE
Summary
Microsoft disclosed a critical remote code execution vulnerability affecting its Entra ID cloud identity service. CVE-2026-69836 received a CVSS score of 10.0 and requires no existing privileges or user interaction to exploit. Microsoft said it fixed the vulnerability and confirmed it was not exploited in the wild. Tracked as CVE-2026-69836, the vulnerability received a CVSS score of 10.0, the highest possible rating.