Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution
Microsoft patched CVE-2026-69836 (CVSS 10.0), a deserialization RCE in Entra ID; the flaw was fully mitigated service-side and was not exploited in the wild.
Microsoft disclosed CVE-2026-69836, a CVSS 10.0 remote code execution flaw in Entra ID caused by deserialization of untrusted data, and said the issue was fully mitigated on the service side with no customer action required. The security bulletin initially marked the flaw as exploited, but Microsoft corrected the status to not exploited in the wild on August 21, 2026. Microsoft credited principal security engineer Robert Fitzpatrick with the discovery. The article also recalls the Lazarus Group's exploitation of Windows WinSock AFD zero-day CVE-2026-68820 (CVSS 7.0) in the Operation Dream Job campaign.
- CVE-2026-69836 rated CVSS 10.0; untrusted deserialization enabling network-based code execution.
- Microsoft corrected the bulletin: the vulnerability was not exploited in the wild.
- Fix deployed on Microsoft's service side; no customer action required.
- Researcher Robert Fitzpatrick discovered and reported the flaw.
- Earlier, Lazarus exploited Windows WinSock AFD flaw CVE-2026-68820 in Operation Dream Job.
- Vendors
- Microsoft
- Products
- Microsoft Entra IDWindows
- Threat actors
- Lazarus Group
- Organizations
- Microsoft
- Countries
- North Korea
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-68820 | Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver | 7.0 | 9% | KEV | KEV |
| CVE-2026-69836 | Unauthenticated Deserialization RCE in Microsoft Entra ID | 10.0 | 2% |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Aug 21, 2026 Vulnerability / Threat Intelligence Update: The story was updated after publication to note that the vulnerability has not been exploited.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.