CVE-2026-69836

CVE-2026-69836 is a deserialization-of-untrusted-data flaw (CWE-502) in Microsoft Entra ID, Microsoft's cloud identity and access management service. An unauthenticated attacker can trigger it by sending crafted serialized data over the network, and the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) confirms that no privileges or user interaction are required. Successful exploitation yields remote code execution with high impact to confidentiality, integrity, and availability, and the changed-scope rating indicates impact can extend beyond the initially affected component. Any organization whose sign-in or identity infrastructure relies on Microsoft Entra ID is potentially in scope, although the source data publishes no specific affected version ranges. There is no known public proof-of-concept, the flaw is not in CISA's KEV, EPSS assigns a 1.6% probability of exploitation within 30 days, and related headlines indicate Microsoft has already patched the issue.

What to do: Because Entra ID is a Microsoft-operated cloud service, there is no on-premises patch to apply; consult Microsoft's advisory to confirm the fix has rolled out to your tenant and whether any tenant-level action is required. Review Entra ID sign-in logs, audit logs, and application registrations for anomalies consistent with pre-authentication exploitation, and monitor Microsoft's advisory and CISA KEV for status changes.