Microsoft patches 22 flaws: Entra ID already secured, but ShieldBreak remains unpatched

On Thursday, Microsoft announced the release of 22 security updates. Most affect cloud services and have already been mitigated on the server side. The most severe vulnerability by score is a remote code execution flaw in Microsoft Entra ID, identified as CVE-2026-69836. Some sources have described it as a zero-day exploited in attacks. Microsoft's official advisory denies that. However, the issue remains open for ShieldBreak, a zero-day flaw in Microsoft Defender that is still unpatched.

CVE-2026-69836: a critical RCE in Entra ID, already mitigated by Microsoft

CVE-2026-69836 involves deserialization of untrusted data in Microsoft Entra ID. It is classified as CWE-502. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The base score is 10.0, the maximum. An unauthenticated attacker can execute code over the network without credentials or user interaction.

According to Microsoft's temporal scoring, the score drops to 8.7. The temporal components are: exploit code maturity "unproven", remediation level "official fix", report confidence "confirmed".

The official MSRC advisory was published on August 20, 2026. The latest update is from August 21, 2026. Microsoft states that the vulnerability is already fully mitigated on the server side. No customer action is required. The purpose of the publication is to provide transparency, as explained in the document "Toward greater transparency: Unveiling Cloud Service CVEs". Credit goes to Robert Fitzpatrick of Microsoft.

Zero-day exploited or not? The divergence between SecurityWeek and the MSRC advisory

SecurityWeek described CVE-2026-69836 as "zero-day exploited in attacks". The article added that Microsoft had not shared information about the attacks. However, the official MSRC advisory tells a different story. At the original publication, the "Publicly Disclosed" and "Exploited" fields were both "No". The exploitability assessment was "Exploitation Less Likely".

Revision 1.1 from August 21 corrected the "Exploited" field to "No". The note specifies that the vulnerability has not been exploited in the wild. This is an informational change only. Readers should therefore consider both versions: the journalistic description mentions active exploitation, but the official advisory states it has not been exploited. The discrepancy has not yet been clarified by the available sources.

Other CVSS 10 flaws: Azure, Exchange Online, Azure Arc

The August package includes five other vulnerabilities with a base score of 10.0 in the NVD database. All describe an unauthenticated attacker operating over the network. CVE-2026-65770 affects Azure Managed Instance for Apache Cassandra and is an argument injection (CWE-88). CVE-2026-65801 affects Microsoft Exchange Online and is an SSRF (CWE-918). CVE-2026-65816 affects Azure Arc and is improper use of names or references (CWE-706). CVE-2026-69502 affects Azure SQL Database and is an SSRF (CWE-918). CVE-2026-69555 also affects Azure Arc and is an incorrect authorization (CWE-863).

The CVSS 3.1 vector is identical for all: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, except for CVE-2026-69502 and CVE-2026-69555, which have availability impact "None" (A:N). Despite this, the base score remains 10.0 due to the "Changed" scope and the confidentiality and integrity impacts. Microsoft has already mitigated all these vulnerabilities on the server side. No customer action is required.

Other critical issues and the cloud package

SecurityWeek lists seven other critical elevation-of-privilege vulnerabilities, all resolved in the same cycle. No CVSS scores or vectors are provided for these. The identifiers are: CVE-2026-68782, CVE-2026-68789, and CVE-2026-66309 for Azure SQL Database; CVE-2026-63509 for Microsoft Fabric; CVE-2026-69851 for Entra ID; CVE-2026-69400 for Azure Logic Apps; CVE-2026-62834 for "Azure Data Factor" (likely a typo for Azure Data Factory).

For CVE-2026-68782, the CVSS score is 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The remaining ones do not have public scores in the available sources.

The source also cites high-severity vulnerabilities fixed in Azure Virtual Machines, Microsoft Partner Center, Azure Data Factory, Azure Stack HCI, Azure Data Manager for Energy, Copilot in Azure, and Windows Remote Help Defense, without listing individual CVE identifiers. Again, most of the cloud vulnerabilities are already mitigated on the server side.

Copilot: command injection fixed earlier this week

SecurityWeek reports that "earlier this week" Microsoft fixed a high-severity command injection bug in Copilot. The vulnerability is identified as CVE-2026-24301. The journalistic description indicates it can be exploited remotely for information disclosure. The full CVSS 3.1 vector, with a score of 8.8, is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The fix has already been deployed and no residual customer actions are indicated.

ShieldBreak: the Defender flaw remains without an official patch

Last week, Microsoft announced it is working on a patch for ShieldBreak. This is a zero-day exploit for Microsoft Defender, released during the August 2026 Patch Tuesday by researcher Nightmare Eclipse, also known as Chaotic Eclipse. The target vulnerability is an elevation of privilege in the Microsoft Malware Protection Engine, identified as CVE-2026-69414. The CVSS score is 7.8, high severity.

Microsoft stated: "Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly known as 'ShieldBreak'. We are working to provide a high-quality security update that addresses the vulnerability." At the time of the source, the patch has not yet been distributed. No workarounds or timelines are indicated.

What users should do

For most of the announced vulnerabilities, users do not need to apply anything. The mitigations for cloud services such as Entra ID, Azure SQL Database, Exchange Online, and others have already been deployed server-side by Microsoft. For Copilot, the fix is already active. For ShieldBreak, however, there is still no official patch and no workarounds are available. Administrators should monitor the Microsoft bulletin for the release of the update.

The exact versions of the affected products have not been disclosed. It is not indicated whether the vulnerabilities have been added to CISA's KEV catalog, nor whether there are operational deadlines imposed. Those managing infrastructures with Microsoft Defender should keep close attention on CVE-2026-69414 and check for updates in the coming hours or days.