Full research report

Microsoft warns of max severity Entra ID flaw exploited in attacks

Original reporting ↗
★ Threat intelligence assessment medium confidence

Executive assessment

CVE-2026-69836 is a technically severe deserialisation flaw in Microsoft Entra ID that would, if reachable and unpatched, allow an unauthenticated attacker to execute code against a cloud identity service that gates access for millions of organisations. The critical finding of this investigation is that the exploitation claim driving the story is not supported by current primary-source evidence: Microsoft corrected its own 'Exploited' advisory label to 'not exploited in the wild' within hours, with no explanation given, and this correction is independently corroborated by The Hacker News, Cybersecurity Dive, CISA's SSVC assessment on the NVD record, the CVSS temporal E:U rating, and the absence of a CISA KEV entry. Whether any exploitation genuinely occurred in the brief window before the service-side patch was applied cannot be determined from available evidence. The broader story of immediate practical relevance is the simultaneous disclosure of five maximum-severity cloud-service vulnerabilities across Entra ID, Azure Arc, Exchange Online, and Apache Cassandra — all self-remediated by Microsoft — which collectively signal heightened research activity on the Azure service security boundary and ongoing risk to organisations that depend heavily on Microsoft cloud identity infrastructure.

What happened

On 21 August 2026, Microsoft disclosed CVE-2026-69836, a maximum-severity (CVSS 10.0) deserialization of untrusted data vulnerability in Microsoft Entra ID that permits unauthenticated, network-reachable remote code execution with no user interaction. The advisory was initially published with an 'Exploited' tag, generating widespread coverage, but Microsoft corrected this label to 'not exploited in the wild' within hours — without providing any explanation for the reversal. The vulnerability was discovered internally by Microsoft Principal Security Engineer Robert Fitzpatrick and was fully mitigated on the service side before public disclosure, with no customer action required. Concurrently, Microsoft disclosed four additional maximum-severity flaws across Azure Arc, Exchange Online, and Azure Managed Instance for Apache Cassandra.

Affected scope

Microsoft Entra ID (all versions of the cloud-managed service, formerly Azure Active Directory), affecting organisations using Microsoft 365, Azure, or Dynamics CRM Online for authentication and access management. Co-disclosed maximum-severity flaws also affect Azure Arc (CVE-2026-65816, CVE-2026-69555), Exchange Online (CVE-2026-65801), and Azure Managed Instance for Apache Cassandra (CVE-2026-65770). In September 2025, a related Entra ID privilege escalation (CVE-2025-55241) enabled full tenant compromise across all Microsoft Entra ID tenants.

Technical assessment

CVE-2026-69836 is classified under CWE-502 (Deserialisation of Untrusted Data). A network-facing Entra ID service endpoint accepted serialised data objects without sufficient validation, enabling an unauthenticated attacker to supply crafted payloads and trigger arbitrary code execution on the underlying service. The CVSS base vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects network delivery with low attack complexity, no privilege or interaction requirement, and a scope change with full confidentiality, integrity, and availability impact. The temporal score of 8.7 is reduced from 10.0 because exploit code was unproven (E:U) at time of disclosure. Because Entra ID is a cloud-managed service, Microsoft was able to remediate the vulnerable infrastructure directly without requiring customer patch deployment.

Recommended defensive actions

  1. Verify that no customer-side action is required for CVE-2026-69836; Microsoft's service-side mitigation is complete, but confirm scope with your Microsoft account team if your organisation has custom Entra ID configurations or federation arrangements.
  2. Review Entra ID sign-in logs, audit logs, and service principal activity from the days preceding and surrounding 21 August 2026 for anomalous authentication attempts, unexpected token issuance, or unauthorised privilege changes, in case exploitation predated the service-side fix.
  3. Audit Entra ID application permissions and service principal assignments using least-privilege principles to limit the blast radius from any future identity-layer compromise.
  4. Subscribe to Microsoft MSRC advisories and CISA alerts to receive prompt notification if exploitation status for CVE-2026-69836 or the co-disclosed Azure Arc and Exchange Online flaws is confirmed or updated.
  5. Integrate Entra ID Identity Protection and Conditional Access risk-based policies to detect and block anomalous sign-in patterns that could indicate post-exploitation credential misuse.

Uncertainties and evidence gaps

  • Whether CVE-2026-69836 was ever genuinely exploited in the wild remains unresolved: Microsoft's initial 'Exploited' advisory label was corrected to 'not exploited' within hours, but no explanation was offered for the original claim or its withdrawal, and it is unknown whether limited exploitation occurred before the service-side patch was applied.
  • No threat actor, campaign, or victim organisation has been identified or attributed in connection with this vulnerability.
  • Microsoft has not disclosed the timeline of when the service-side patch was deployed relative to when the vulnerability was first discovered or potentially exploited, making the window of exposure impossible to assess.
  • The full technical and exploitation details of the four co-disclosed maximum-severity cloud flaws (CVE-2026-65816, CVE-2026-69555, CVE-2026-65801, CVE-2026-65770) have not been independently corroborated beyond Microsoft's initial advisory language.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated; network-reachable with no credentials or user interaction required
ComponentMicrosoft Entra ID network-facing serialisation processing layer (cloud-managed identity and access management service)
MechanismInsufficient validation of attacker-supplied serialised data objects accepted by a network-facing Entra ID endpoint, classified CWE-502 (Deserialisation of Untrusted Data)
ImpactFull confidentiality, integrity, and availability compromise with scope change, potentially affecting dependent Microsoft 365, Azure, and SaaS resources relying on Entra ID for authentication
DetectionMonitor Entra ID sign-in and audit logs for anomalous authentication patterns, unexpected service principal creation, or privilege escalation; no specific indicator of compromise has been published by Microsoft
MitigationFully mitigated by Microsoft on the service side as of 21 August 2026; no customer patch or configuration change is required
Exploitation status

No confirmed active exploitation; Microsoft initially published CVE-2026-69836 with an 'Exploited' tag but corrected this to 'not exploited in the wild' within hours of the 21 August 2026 disclosure; no public proof-of-concept exists; CVE-2026-69836 is absent from the CISA Known Exploited Vulnerabilities catalogue; the CVSS temporal vector (E:U) reflects unproven exploit maturity.

Research process

Research began with the BleepingComputer article claiming CVE-2026-69836 was actively exploited, then used independent sources across NVD, The Hacker News, Cybersecurity Dive, Help Net Security, The Register, and GBHackers to validate technical claims and resolve a material discrepancy. Multiple sources confirmed that Microsoft corrected its initial 'Exploited' advisory status to 'not exploited in the wild' within hours of disclosure — a fact absent from the original article and corroborated by the CVSS temporal score (E:U) and absence from the CISA KEV catalogue. This correction is the central evidentiary finding of the investigation: the headline exploitation claim is not currently supported by primary-source evidence.

  1. What does the primary source article claim about CVE-2026-69836?
    Fetched the BleepingComputer article to extract all stated facts.
    bleepingcomputer.com ↗

    Article reports CVE-2026-69836 as a CVSS 10.0 Entra ID deserialisation RCE flaw discovered by Microsoft's Robert Fitzpatrick, fully patched server-side, and claimed as exploited in the wild. Four co-disclosed max-severity flaws across Azure Arc, Exchange Online, and Apache Cassandra noted alongside a prior Entra ID CVE from September 2025.

    why Established the story's core claims. The exploitation assertion was the primary claim requiring independent verification.

  2. Do independent outlets corroborate the technical details and exploitation status?
    Searched for CVE-2026-69836 across security news outlets.

    Multiple independent outlets confirmed the CVSS 10.0 rating, CWE-502 classification, unauthenticated RCE vector, and server-side remediation. The Hacker News result indicated a potential exploitation status correction warranting further investigation.

    why Confirmed technical consensus across multiple domains and surfaced a material discrepancy on exploitation status that required direct verification.

  3. What unique details does Help Net Security provide?
    Fetched the Help Net Security article.
    helpnetsecurity.com ↗

    Independently confirmed CVSS 10.0, unauthenticated network RCE, no customer action needed. Noted that Microsoft provided no details on exploitation scope, timeline, or affected organisations — an unusual gap for a claimed actively exploited vulnerability.

    why Corroborated core technical details from a second independent domain. The absence of exploitation detail from Microsoft was a signal to pursue the status correction further.

  4. Did The Hacker News report a correction to Microsoft's exploitation status?
    Fetched The Hacker News article.
    thehackernews.com ↗

    Confirmed that Microsoft initially published the advisory with 'Exploited' status but corrected it to 'not exploited in the wild' on 21 August 2026 after The Hacker News contacted Microsoft for clarification.

    why This is the single most important finding in the investigation. It directly contradicts the headline exploitation claim and changes the immediate risk assessment for defenders.

  5. What does the NVD record state about exploitation and CVSS details?
    Fetched the NVD entry for CVE-2026-69836.
    nvd.nist.gov ↗

    NVD confirmed CVSS 10.0, CWE-502, and full scope change impact vector. CISA's SSVC assessment on the same record states 'no known exploitation'. The record was still under NVD enrichment as of 22 August 2026.

    why A government-sourced record corroborating the corrected 'not exploited' status from an authoritative independent source, strengthening the case against the original exploitation claim.

  6. Does The Register independently corroborate or refute the exploitation status correction?
    Fetched The Register article.
    theregister.com ↗

    The Register treated exploitation as confirmed based on the initial advisory; no coverage of the subsequent correction, suggesting publication preceded the advisory update.

    why Confirmed technical details but this article predates the correction. It cannot be used as evidence of confirmed exploitation — it reflects the advisory as initially published.

  7. Does Cybersecurity Dive confirm the exploitation status reversal with independent detail?
    Fetched the Cybersecurity Dive article.
    cybersecuritydive.com ↗

    Confirmed Microsoft updated the advisory to state 'no exploitation', with no explanation provided for the status change. Microsoft declined to elaborate on exploitation timeline, scope, or technical details.

    why Second independent editorial source confirming the correction, from a publication that separately contacted Microsoft. Establishes the correction as a reliable published finding rather than a single-outlet observation.

  8. Does the CVSS temporal score provide additional signal on exploit availability?
    Fetched GBHackers article for CVSS temporal detail.
    gbhackers.com ↗

    CVSS temporal score is 8.7 rather than 10.0 base, because exploit maturity is rated Unproven (E:U), meaning no functional exploit code was known to exist at disclosure.

    why The E:U temporal modifier independently corroborates the 'not exploited' corrected status: Microsoft's own scoring acknowledged no proven exploit at time of publication.

  9. Is CVE-2026-69836 or any co-disclosed CVE listed in the CISA Known Exploited Vulnerabilities catalogue?
    Searched CISA KEV for CVE-2026-69836 and related CVEs.

    CVE-2026-69836 is not listed in the CISA KEV catalogue as of August 2026. No co-disclosed CVE from this cluster was found in KEV alerts.

    why Absence from KEV is consistent with the corrected 'not exploited' status. CISA requires confirmed exploitation evidence before KEV listing; the absence adds a further layer of corroboration.

Named in this story
TargetsMicrosoft Entra ID tenantsMicrosoft 365 customersAzure customersDynamics CRM Online customers
Related CVEs CVE-2026-69836CVE-2026-65816CVE-2026-69555CVE-2026-65801CVE-2026-65770CVE-2025-55241

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (2 primary, 2 corroborating, 1 contextual and 0 PoC/exploit references). 56 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok9 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research.
NVDcve ok900 records Primary evidence1 matched items Supplied a vendor or government advisory opened and verified during focused research.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
CISA KEVkev ok1674 records Corroborating1 matched items A page from this source was opened and verified during focused research.
FIRST EPSSepss ok7871 records Context1 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5332 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok686 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1009 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok4 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok11 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok14 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1590 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok2 records Checked — no match The source completed, but none of its retained records matched this story.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok7 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 6 opened outside the registered collection
References & evidence
Vulnerability & exploitation1
CVE-2026-69555 EPSS 0.5% 38th percentile exploitation probability
Vendor & gov advisories2
CVE-2026-69836 – National Vulnerability Database (NVD) nvd.nist.gov ↗

Confirms CVSS 10.0 and CWE-502; CISA SSVC assessment states no known exploitation as of 22 August 2026.

Microsoft Security Response Center – CVE-2026-69836 msrc.microsoft.com ↗

Primary vendor advisory; page content not fully retrievable via automated fetch but URL confirmed by all corroborating sources as the authoritative record.

Analysis & research6
Microsoft warns of max severity Entra ID flaw exploited in attacks – BleepingComputer bleepingcomputer.com ↗

Primary news report; reflects the initial advisory language before Microsoft's exploitation status correction.

Critical Microsoft Entra ID vulnerability exploited in the wild – Help Net Security helpnetsecurity.com ↗

Independent corroboration of technical details; highlights Microsoft's unusual opacity on exploitation scope.

Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild – The Hacker News thehackernews.com ↗

Key source: reports that Microsoft corrected exploitation status to 'not exploited in the wild' on 21 August 2026 following press enquiry.

Microsoft discloses maximum severity flaw in Entra ID – Cybersecurity Dive cybersecuritydive.com ↗

Second independent source confirming Microsoft updated the advisory on 22 August 2026 to state no exploitation, without explanation.

Microsoft sounds alarm as perfect-10 Entra ID flaw comes under attack – The Register theregister.com ↗

Corroborates technical details; based on initial advisory wording before the exploitation status correction.

Microsoft Entra ID RCE Flaw – GBHackers gbhackers.com ↗

Provides CVSS temporal score (8.7, E:U) confirming unproven exploit maturity at time of disclosure.