CVE-2026-69836: Critical Vulnerability Exploited in Microsoft Entra ID, but Customers Need Take No Action

Microsoft has fixed a critical vulnerability in Microsoft Entra ID, its cloud-based identity and access management service formerly known as Azure Active Directory. The flaw, tracked as CVE-2026-69836, was exploited in attacks, according to the information associated with Microsoft’s advisory.

The vulnerability was publicly disclosed on August 20, 2026. Microsoft has assigned it the highest severity rating and says it has been fully mitigated in its service.

Customers do not need to take any action: there are no patches to install, manual configuration changes to make, or workarounds to apply.

Deserialization Vulnerability Leads to Remote Code Execution

CVE-2026-69836 is classified as CWE-502, Deserialization of Untrusted Data. The issue affects how the service processes untrusted data and could allow an unauthorized attacker to execute code over the network.

Exploitation does not require:

• privileges;
• prior authentication;
• user interaction.

The attack vector is therefore remote, and the complexity is low. The CVSS 3.1 score is 10.0, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

The S:C parameter indicates that the impact can extend beyond the security scope of the component initially affected. Impacts on confidentiality, integrity, and availability are all rated high.

In practical terms, successful exploitation could fully compromise resources affected by the service, although the publicly available technical brief does not describe the attack chain or the precise operational conditions observed in the incidents.

Microsoft Confirms Exploitation, but No Public Exploit Exists

The MSRC advisory states that the vulnerability has been exploited, but that it has not been publicly disclosed. Microsoft also says that no exploit code is available online.

These two details are not contradictory. An attack may have been observed or identified by the vendor without the associated code being published, openly shared, or incorporated into tools accessible to attackers.

MSRC also assigns the vulnerability the following temporal and confidence metrics:

• Exploit Code Maturity: E:U, meaning that a public exploit has not been demonstrated or that exploitation remains theoretical;
• Remediation Level: RL:O, because an official service-side fix is available;
• Report Confidence: RC:C, indicating that the vulnerability has been confirmed by the vendor.

The discovery is credited to Microsoft principal security engineer Robert Fitzpatrick. However, the advisory’s acknowledgments section lists the surname as Robert Fitzaptrick.

Cloud Service Used by Microsoft 365, Azure, and Dynamics Is Affected

The affected product is Microsoft Entra ID, listed in NVD information with version - and affected status. No specific build numbers or version ranges have been published.

This is consistent with the product’s cloud-based nature. Entra ID provides authentication, policy enforcement, and protection for applications and resources used by customers of:

• Microsoft 365;
• Microsoft Azure;
• Dynamics CRM Online.

A problem in the identity service can have broad consequences because Entra ID controls access to numerous environments and applications. However, no details have been released that would make it possible to determine which tenants, configurations, or resources were actually affected.

NVD has not yet published its own CVSS 4.0 or CVSS 2.0 assessment: both fields are listed as N/A. The available score is the CVSS 3.1 rating assigned by Microsoft as the CNA.

Mitigation Was Applied Entirely on Microsoft’s Side

Microsoft states that CVE-2026-69836 has been fully mitigated on the service side. The advisory specifies that customers:

• do not need to install updates;
• do not need to perform manual procedures;
• have no specific workarounds available;
• do not need to change configurations to apply the fix.

As a result, administrators do not have a patch to deploy to corporate clients or servers. The main operational recommendation is nevertheless to continue monitoring Entra ID access and authentication events in accordance with normal internal procedures.

Microsoft has not published indicators of compromise, detection queries, SIEM rules, or specific logs to look for. The advisory therefore does not provide a dedicated list of technical traces associated with CVE-2026-69836.

The Vulnerability Follows a Series of Critical Microsoft Flaws

The issue follows four other Microsoft vulnerabilities rated at the highest severity and addressed the previous day:

• CVE-2026-65816 in Azure Arc, potentially allowing remote privilege escalation;
• CVE-2026-69555 in Azure Arc, also associated with remote privilege escalation;
• CVE-2026-65801 in Exchange Online, allowing remote privilege escalation;
• CVE-2026-65770 in Azure Managed Instance for Apache Cassandra, allowing remote code execution.

All four have a CVSS 3.1 score of 10.0. For CVE-2026-65816, CVE-2026-65801, and CVE-2026-65770, the vector matches that of CVE-2026-69836. CVE-2026-69555 instead lists availability as not applicable in its published vector.

There is also a direct precedent involving Entra ID. In September 2025, Microsoft fixed CVE-2025-55241, a critical privilege escalation vulnerability reported by Dirk-jan Mollema of Outsider Security. According to the report published at the time, exploitation could have enabled full access to an organization’s Entra tenant.

KEV and Response Activity

There is no reported inclusion of CVE-2026-69836 in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Consequently, no inclusion date or CISA deadline has been reported for this specific vulnerability.

The catalog has nevertheless received other Microsoft-related vulnerabilities over the past 90 days:

• CVE-2026-55040, added on August 18, 2026;
• CVE-2026-33824, added on August 18, 2026;
• CVE-2026-68820, added on August 11, 2026;
• CVE-2026-50522, added on July 22, 2026;
• CVE-2026-58644, added on July 16, 2026;
• CVE-2026-45659, added on July 1, 2026, with an indication of ransomware use.

In a separate update, CISA also added a critical remote code execution vulnerability in the Windows Internet Key Exchange (IKE) Service Extensions component to the catalog. No CVE identifier or KEV deadline was provided for that case.

For CVE-2026-69836, therefore, the operational situation differs from that of a vulnerability requiring installation: Microsoft says it has already applied the mitigation to the cloud service and does not require customers to take action.