Full research report
Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution
Executive assessment
This report covers two editorially linked but operationally distinct vulnerabilities. CVE-2026-69836, the headline maximum-severity flaw, was subject to a Microsoft bulletin error that initially marked it as exploited; the vendor's own correction, issued the same day as widespread media coverage, confirms it was never exploited and has been fully remediated server-side with no customer action needed — Help Net Security had not updated its article to reflect this, producing a visible discrepancy across outlets. The genuinely critical operational story is CVE-2026-68820: a Windows kernel use-after-free exploited by North Korea's Lazarus Group for at least five weeks before patching, delivering a sophisticated multi-stage toolchain — FudModule v3.1 rootkit, Troy backdoor, and MISTPEN downloader — against defence, aerospace, and aviation targets across Western Europe, South Asia, and South America. CISA's same-day KEV addition reinforces the urgency of patching all supported Windows versions. Defenders should treat the two CVEs separately: the Entra ID flaw requires no action, while the Windows kernel flaw demands immediate patch deployment and active hunting for Lazarus indicators.
What happened
Microsoft disclosed two separate vulnerabilities around its August 2026 Patch Tuesday release. CVE-2026-69836, a CVSS 10.0 deserialisation remote code execution flaw in Microsoft Entra ID, was initially marked as exploited in Microsoft's own security bulletin; Microsoft corrected that status to 'No' on 21 August 2026, stating the CVE was released for transparency around an internally discovered and remediated issue. CVE-2026-68820, a use-after-free elevation-of-privilege flaw in the Windows Ancillary Function Driver for WinSock (afd.sys), is confirmed exploited in the wild: Check Point Research attributed it to the DPRK-linked Lazarus Group in Operation Dream Job, with artefact evidence placing exploitation from at least 7 July 2026 — five weeks before the patch shipped on 11 August 2026. CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalogue on the same day as the patch.
Affected scope
CVE-2026-69836 affects Microsoft Entra ID (fully cloud-managed; no on-premises customer component). CVE-2026-68820 affects all supported Windows versions: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 26H1), and Windows Server 2012 through 2025. Confirmed Lazarus Group targets span defence, aerospace, and aviation organisations in France, Germany, India, and Brazil, with additional activity observed in South America.
Technical assessment
CVE-2026-69836 is a CWE-502 (Deserialisation of Untrusted Data) flaw in Entra ID's cloud infrastructure; an unauthenticated attacker could supply malicious serialised data to a network-accessible service endpoint to trigger code execution within Microsoft's managed layer. The full remediation was applied server-side by Microsoft. CVE-2026-68820 is a use-after-free race condition in afd.sys, the kernel-mode driver underpinning Windows socket operations. Lazarus exploited it via the FudModule v3.1 kernel-mode rootkit to gain SYSTEM-level privileges after initial access via trojanised job-offer lures, then deployed the Troy modular backdoor for command-and-control, file operations, and DLL injection, while using compromised Roundcube mail infrastructure (via CVE-2025-49113) as relay nodes.
Recommended defensive actions
- Apply the August 2026 Patch Tuesday cumulative updates immediately: KB5121003 for Windows 11 and KB5120249 for Windows 10 under Extended Security Updates, to remediate CVE-2026-68820
- Hunt for Operation Dream Job indicators across endpoints and network logs: artefacts include MISTPEN, FudModule v3.1, Troy, SecurityPDF, RelayShell, and ForestTiger, using indicators from the Check Point Research report
- Audit Entra ID sign-in and audit logs for anomalous service-principal modifications, unexpected network-originated authentication events, or unusual application access patterns around August 2026
- Verify patch deployment for CVE-2026-68820 against CISA BOD 26-04 timelines if operating federal or critical infrastructure environments
- Subscribe to Microsoft Security Update Guide notifications and Entra ID service health alerts to receive timely advisories on future cloud-service remediations that require no customer action
Uncertainties and evidence gaps
- Microsoft has not disclosed the timeline, scope, or nature of any access to Entra ID infrastructure before the server-side fix was applied for CVE-2026-69836; it remains unknown whether any tenant data was exposed
- Help Net Security's article on CVE-2026-69836, fetched on 22 August 2026, still states the vulnerability was actively exploited — contradicting Microsoft's same-day correction; it is unclear whether this reflects pre-correction publication timing or access to separate undisclosed information
- The full geographic and organisational scope of CVE-2026-68820 exploitation beyond the four confirmed countries has not been published by Check Point Research or any independent source
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
CVE-2026-69836 was not exploited — Microsoft corrected a mistaken 'Yes' bulletin marking to 'No' on 21 August 2026; CVE-2026-68820 carries confirmed active exploitation by Lazarus Group in Operation Dream Job from at least 7 July 2026, with CISA KEV addition on 11 August 2026.
The investigation began with two CVEs linked in a single headline but representing entirely different events. Fetching the updated THN article established the key correction: CVE-2026-69836 was not exploited, despite an initial Microsoft bulletin error. The operationally significant story proved to be CVE-2026-68820, where Check Point Research's primary report and independent Bleeping Computer coverage confirmed nation-state exploitation by Lazarus Group over five weeks, with CISA KEV addition as an authoritative government corroboration. A source contradiction was identified — Help Net Security's article still asserts exploitation of CVE-2026-69836 — and resolved in favour of Microsoft's direct vendor statement.
- What are the basic details and exploitation status of CVE-2026-69836?Searched for 'CVE-2026-69836 Microsoft Entra ID remote code execution CVSS 10.0 2026'
Multiple outlets confirmed a CVSS 10.0 CWE-502 deserialisation RCE in Entra ID, initially marked exploited, with Microsoft remediating server-side and requiring no customer action
why Established vulnerability identity and surfaced the exploitation claim requiring independent verification
- Is CVE-2026-68820's attribution to Lazarus Group confirmed, and what is Operation Dream Job?Searched for 'CVE-2026-68820 Windows Ancillary Function Driver WinSock Lazarus Group Operation Dream Job 2026'
Check Point Research attributed CVE-2026-68820 to Lazarus Group via Operation Dream Job; use-after-free in afd.sys exploited with FudModule rootkit; defence/aerospace targets in France, Germany, Brazil, India
why Confirmed threat-actor attribution and campaign context for the confirmed-exploitation CVE
- Did Microsoft correct CVE-2026-69836's exploitation status, and what exactly did they say?Fetched THN articlethehackernews.com ↗
Microsoft corrected 'Exploited' from 'Yes' to 'No' on 21 August 2026 and stated 'this vulnerability was not exploited in the wild'; the CVE was released 'for greater transparency'
why Critical status reversal from the primary vendor — changes the headline claim from confirmed exploitation to denied
- Is CVE-2026-68820 confirmed in CISA's KEV catalogue and what are BOD 26-04 obligations?Searched for 'CISA KEV CVE-2026-68820 known exploited vulnerability catalog 2026'
CISA added CVE-2026-68820 on 11 August 2026 (same day as the Microsoft patch); BOD 26-04 imposes remediation timelines of 3–14 days for federal agencies; Qualys rates the KB updates as high reliability
why Government-authoritative exploitation confirmation independent of vendor or researcher statements
- What is the full technical detail of the Lazarus Operation Dream Job campaign using CVE-2026-68820?Fetched Check Point Research primary reportresearch.checkpoint.com ↗
Exploitation began 7 July 2026 (five weeks before patch); chain includes MISTPEN downloader, FudModule v3.1 rootkit, Troy 17-command backdoor, SecurityPDF lure, RelayShell C2 relay, ForestTiger persistence; CVE-2025-49113 abused for Roundcube server access
why Primary research source providing the most authoritative account of the exploitation chain, timeline, and targeting
- Does an independent source corroborate Check Point's findings?Fetched Bleeping Computer articlebleepingcomputer.com ↗
Independently confirmed Lazarus attribution, FudModule and Troy deployment, defence and aerospace targeting across France, Germany, India, and Brazil
why Second independent source from a separate editorial domain corroborating the campaign details
- Does Help Net Security provide additional detail on CVE-2026-69836 or contradict the exploitation status correction?Fetched Help Net Security articlehelpnetsecurity.com ↗
Article still states CVE-2026-69836 was actively exploited in the wild, contradicting Microsoft's same-day correction — discrepancy likely reflects publication before the correction was issued
why Identified a material source contradiction; Microsoft's direct vendor statement to THN is the stronger authority and was resolved accordingly
- What are the specific patch KB numbers and how many CVEs were addressed in August 2026 Patch Tuesday?Fetched Tenable Patch Tuesday analysistenable.com ↗
August 2026 Patch Tuesday addressed 398 CVEs; CVE-2026-68820 patched 11 August 2026, CVSS 7.0 Important; KB5121003 for Windows 11 and KB5120249 for Windows 10 ESU confirmed
why Provides actionable patch KB numbers and confirms the scale of the release for defensive prioritisation
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (2 primary, 2 corroborating, 1 contextual and 0 PoC/exploit references). 56 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| CISA KEVkev | ok1674 records | Primary evidence2 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok7 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| BleepingComputernews | ok9 records | Corroborating1 matched items | Supplied independent analysis opened and verified during focused research. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok7871 records | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5332 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok686 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1009 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok11 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok18 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok14 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1590 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 6 opened outside the registered collection
Vulnerability & exploitation2
PoC & exploit code1
Primary technical write-up on CVE-2026-68820 exploitation; describes FudModule v3.1 rootkit, Troy backdoor, and full attack chain
Vendor & gov advisories1
CISA KEV entry confirming CVE-2026-68820 actively exploited; page returned HTTP 403 during fetch but independently corroborated by Qualys, WindowsForum, and the provided source brief
Analysis & research3
Independent corroboration of Lazarus attribution, FudModule and Troy deployment, and defence/aerospace targeting
Still states exploited despite Microsoft's same-day correction; useful for documenting the reporting discrepancy
Confirms CVE-2026-68820 patch details, KB numbers, and Patch Tuesday context