Microsoft patches critical Entra ID vulnerability (CVE-2026-69836)
Microsoft patched critical Entra ID RCE CVE-2026-69836 (CVSS 10.0), fully mitigated server-side with no customer action; no in-the-wild exploitation confirmed.
Microsoft patched CVE-2026-69836, a critical (maximum CVSS 10.0) unauthenticated remote code execution flaw in Entra ID caused by deserialization of untrusted data over a network. Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity service verifying logins and controlling access to Microsoft 365, Azure, and connected third-party apps. The flaw was discovered by Microsoft Principal Security Engineer Robert Fitzpatrick and fully mitigated server-side, requiring no customer action. Microsoft initially reported the bug as exploited, but later changed the status to 'no' and confirmed the vulnerability was not exploited in the wild.
- Unauthenticated RCE via deserialization of untrusted data in Microsoft's cloud identity service.
- Discovered by Microsoft Principal Security Engineer Robert Fitzpatrick.
- Fully mitigated server-side; no customer remediation required.
- Exploitation status revised from exploited to not exploited on August 24, 2026.
- CVEs
- CVE-2026-69836
- Vendors
- Microsoft
- Products
- Entra IDMicrosoft 365Azure
- Organizations
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-69836 | Unauthenticated Deserialization RCE in Microsoft Entra ID | 10.0 | 2% |
From the original article
1 min read at helpnetsecurity.com
Microsoft has patched a critical remote code execution vulnerability (CVE-2026-69836) in Entra ID, initially reported to have been exploited in the wild. Entra ID is Microsoft’s cloud identity service, formerly Azure Active Directory, that verifies logins and controls access to Microsoft 365, Azure, and connected third-party apps. Tracked as CVE-2026-69836, with the maximum CVSS score of 10.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.