Microsoft Patches Critical 'Perfect 10' Exploit in Entra ID

According to Microsoft's security advisory, the vulnerability can be exploited over a network with low attack complexity. The issue stems from a deserialization flaw, where an application does not properly validate data, allowing an attacker to manipulate it for malicious code execution.

Microsoft stated that the company identified and fixed the vulnerability before publishing the CVE. A spokesperson confirmed that the fix was released for greater transparency and that no additional actions are required from customers. Researchers later revised the exploitation status from 'Yes' to 'No,' confirming that the vulnerability was not exploited in the wild. Microsoft noted that the flaw was not publicly disclosed, making exploitation less likely.

The article also touches upon the increasing role of artificial intelligence in discovering security vulnerabilities, citing examples of AI systems being used by researchers and companies to identify flaws. Microsoft itself is developing AI tools for vulnerability discovery, including its MAI-Cyber-1-Flash cybersecurity model.