Microsoft has patched a critical security vulnerability in its Entra ID identity platform that received the maximum possible severity rating, warning that the flaw could have allowed attackers to remotely execute code before it was fixed.
A Maximum-Severity Threat
The vulnerability, tracked under a newly published CVE, earned a rare "perfect 10" on the Common Vulnerability Scoring System — the highest possible severity score, reserved for the most dangerous flaws. Such ratings typically indicate a bug that is easy to exploit and capable of causing severe damage across affected systems.
Entra ID, formerly known as Azure Active Directory, serves as Microsoft's cloud-based identity and access management service. It underpins authentication for countless organizations, meaning a successful attack against it could have opened the door to sweeping unauthorized access.
A flaw scoring a perfect 10 is the security world's equivalent of a five-alarm fire.
Patched Before Disclosure
Microsoft said it had already addressed the vulnerability before publishing the CVE, closing the window of exposure ahead of any public disclosure. The company also stated that it found no evidence the bug had ever been exploited in the wild.
The proactive approach reflects a standard practice among major software vendors, who often quietly deploy fixes before formally documenting vulnerabilities to reduce the risk of attackers reverse-engineering patches to build exploits.
Key points from the disclosure include:
- The flaw affected Microsoft's Entra ID identity platform
- It carried the maximum CVSS severity score of 10
- The bug could have enabled remote code execution
- Microsoft says it was patched before the CVE went public
- No evidence of exploitation was found
For organizations relying on Microsoft's cloud infrastructure, the incident serves as a reminder of how central identity platforms have become to overall security — and how a single high-severity flaw could ripple across enterprise environments if left unaddressed.