Microsoft disclosed a critical remote code execution vulnerability affecting its Entra ID cloud identity service.