Microsoft disclosed and quietly patched a maximum-severity remote code execution flaw in Entra ID, the cloud identity service formerly known as Azure Active Directory, after confirming it had already been exploited in the wild. CVE-2026-69836 carries a CVSS score of 10.0 — the ceiling of the scale — and required no authentication, no privileges, and no user interaction to trigger.

What happened

Entra ID sits at the center of identity and access management for Microsoft 365, Azure, and every third-party application that federates against it — it’s the component that validates who a user is and what they’re allowed to touch. CVE-2026-69836 is a deserialization of untrusted data vulnerability (CWE-502) in that backend: a service endpoint accepted specially crafted serialized data objects and processed them without adequately validating their structure or origin first. An attacker able to reach the vulnerable endpoint could craft a malicious payload that, once deserialized, executed arbitrary code on Microsoft’s infrastructure — over the network, with zero credentials.

Deserialization bugs are a well-worn class of vulnerability precisely because they collapse the distance between “attacker-controlled input” and “code execution” to almost nothing: if an application blindly reconstructs objects from untrusted bytes, the attacker gets to define what those objects do when they’re instantiated. What makes this instance unusual is where it landed — not in a customer-managed appliance or on-prem server, but inside the multi-tenant control plane that underpins authentication for a meaningful fraction of the enterprise internet.

Because Entra ID is a fully managed SaaS platform, there’s no patch for customers to apply, no KB article, and no configuration change to make. Microsoft rolled the fix out to its own infrastructure and says the vulnerability is now fully mitigated. The company has not disclosed who exploited it, when the attacks began, how many tenants were affected, or the specific mechanics of the observed exploitation chain — a pattern consistent with an internally-observed intrusion Microsoft wants to close before publishing a roadmap for copycats.

Affected scope

  • Entra ID (formerly Azure Active Directory) — Microsoft’s cloud identity and access management platform
  • No customer-managed component is involved; the flaw was in Microsoft-operated backend infrastructure
  • Any organization relying on Entra ID for Microsoft 365, Azure resource access, or third-party SSO/federation sat behind the vulnerable service during the exposure window

Impact

A pre-auth RCE in the identity plane is about as high-value a target as exists in cloud infrastructure. Successful exploitation of a flaw like this could, in principle, let an attacker manipulate authentication tokens, alter conditional-access and authorization policies, or pivot laterally across every tenant and connected application that trusts Entra ID’s verdicts — without ever needing a valid credential to start. Because the vulnerable component lived entirely in Microsoft’s own infrastructure, defenders had no logs, no telemetry, and no way to detect or scope exploitation attempts against their own tenants independently; visibility into “was I hit” rests entirely on what Microsoft chooses to disclose.

The severity here isn’t hypothetical bookkeeping — CVSS 10.0 is reserved for flaws with unauthenticated network access, no complexity, and full compromise of confidentiality, integrity, and availability. Microsoft’s confirmation that it was actively exploited before disclosure removes any ambiguity about whether this was a theoretical risk.

Mitigation

  • No customer action is required or possible. Microsoft has already deployed the fix service-side; there is nothing to patch, upgrade, or reconfigure on the customer end.
  • Review Entra ID sign-in and audit logs for the period leading up to disclosure (Aug 20–21, 2026) for anomalies: unexpected privileged role assignments, new or modified conditional-access policies, unfamiliar service principal or app registration activity, and token issuance patterns inconsistent with normal usage.
  • Tighten what you can control independently of the platform bug: enforce conditional access with phishing-resistant MFA, minimize standing privileged role assignments, enable Continuous Access Evaluation where available, and alert on privileged-role and app-registration changes in near real time — none of these would have stopped this specific flaw, but they reduce blast radius from the class of identity-plane compromises this represents.
  • Treat any unexplained authentication anomaly from this window as a priority investigation, since Microsoft has not published indicators of compromise or a technical writeup that would let defenders hunt precisely.

Sources

  • Microsoft Security Response Center advisory for CVE-2026-69836
  • The Hacker News, “Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution”
  • BleepingComputer, “Microsoft warns of max severity Entra ID flaw exploited in attacks”
  • Help Net Security, “Critical Microsoft Entra ID vulnerability exploited in the wild (CVE-2026-69836)”
  • The Register, “Microsoft sounds alarm as perfect-10 Entra ID flaw comes under attack”