ZeroHour

CVE-2026-69836

mass

Unauthenticated Deserialization RCE in Microsoft Entra ID

CVSS 3.1
10.0 critical
EPSS
2%p74
Published
()
Modified
AI analysis

CVE-2026-69836 is a deserialization-of-untrusted-data flaw (CWE-502) in Microsoft Entra ID, Microsoft's cloud identity and access management service. An unauthenticated attacker can trigger it by sending crafted serialized data over the network, and the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) confirms that no privileges or user interaction are required. Successful exploitation yields remote code execution with high impact to confidentiality, integrity, and availability, and the changed-scope rating indicates impact can extend beyond the initially affected component. Any organization whose sign-in or identity infrastructure relies on Microsoft Entra ID is potentially in scope, although the source data publishes no specific affected version ranges. There is no known public proof-of-concept, the flaw is not in CISA's KEV, EPSS assigns a 1.6% probability of exploitation within 30 days, and related headlines indicate Microsoft has already patched the issue.

What to do: Because Entra ID is a Microsoft-operated cloud service, there is no on-premises patch to apply; consult Microsoft's advisory to confirm the fix has rolled out to your tenant and whether any tenant-level action is required. Review Entra ID sign-in logs, audit logs, and application registrations for anomalies consistent with pre-authentication exploitation, and monitor Microsoft's advisory and CISA KEV for status changes.

Affected
Microsoft Entra ID
Estimated exposure
masshundreds of millions of users across effectively all Microsoft 365/Azure tenants (on the order of millions of organizations) — Entra ID (formerly Azure Active Directory) is the identity backbone for Microsoft 365 and Azure, so nearly every Microsoft cloud tenant is exposed until the service-side fix is confirmed, putting exposure in the hundreds-of-millions of…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

Vendors
microsoft
Products
entra id
Weakness
CWE-502
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

In the news

Microsoft patches critical Entra ID vulnerability (CVE-2026-69836)

Microsoft patched critical Entra ID RCE CVE-2026-69836 (CVSS 10.0), fully mitigated server-side with no customer action; no in-the-wild exploitation confirmed.

Microsoft patched CVE-2026-69836, a critical (maximum CVSS 10.0) unauthenticated remote code execution flaw in Entra ID caused by deserialization of untrusted data over a network. Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity service verifying logins and controlling access to Microsoft 365, Azure, and connected third-party apps. The flaw was discovered by Microsoft Principal Security Engineer Robert Fitzpatrick and fully mitigated server-side, requiring no customer action. Microsoft initially reported the bug as exploited, but later changed the status to 'no' and confirmed the vulnerability was not exploited in the wild.

Help Net Security · 22d agoVulnerabilityCVE-2026-69836

Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution

Microsoft patched CVE-2026-69836 (CVSS 10.0), a deserialization RCE in Entra ID; the flaw was fully mitigated service-side and was not exploited in the wild.

Microsoft disclosed CVE-2026-69836, a CVSS 10.0 remote code execution flaw in Entra ID caused by deserialization of untrusted data, and said the issue was fully mitigated on the service side with no customer action required. The security bulletin initially marked the flaw as exploited, but Microsoft corrected the status to not exploited in the wild on August 21, 2026. Microsoft credited principal security engineer Robert Fitzpatrick with the discovery. The article also recalls the Lazarus Group's exploitation of Windows WinSock AFD zero-day CVE-2026-68820 (CVSS 7.0) in the Operation Dream Job campaign.