Entra ID CVE-2026-69836: CVSS 10, Exploited, KEV

Microsoft on Thursday disclosed that CVE-2026-69836 — a deserialization of untrusted data flaw in Entra ID — carries a maximum CVSS score of 10.0 and has been exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog the same day, giving federal agencies until August 24 to comply under BOD 26-04.

The flaw

Entra ID (formerly Azure Active Directory) contains a deserialization vulnerability that allows an unauthenticated attacker to execute arbitrary code over a network — no credentials, no user interaction required. The CISA KEV entry describes it as an exploit that “could allow an unauthorized attacker to execute code over a network,” and the NVD record confirms the 10.0 critical rating.

No customer patch, but don’t skip the audit

According to reporting from BleepingComputer and The Hacker News, Microsoft resolved CVE-2026-69836 server-side. If you’re running Entra ID, your tenant is already operating against patched infrastructure — there is no update for customers to install.

What the server-side fix does not do is close the exploitation window retroactively. Confirmed in-the-wild exploitation means some organizations were hit before the patch landed. That’s the audit trigger.

What to actually do

Federal agencies and contractors: the CISA KEV deadline is August 24, 2026. Under BOD 26-04, you must apply mitigations per vendor instructions — in this case, confirm your Entra ID tenant is operating against the patched service and document compliance. If mitigations are not available for any reason, BOD 26-04 requires risk-based justification.

All other organizations:

• Pull Entra ID sign-in and audit logs for the days preceding August 21. Flag anomalous service-principal authentication activity, unexpected application access, or identity API calls that don’t match normal baselines.
• If you’ve been investigating unexplained RCE or lateral movement in your Microsoft 365 environment over the past several weeks, add CVE-2026-69836 to the differential.
• There is no customer-side patch to track — Microsoft controls the infrastructure fix. The work here is forensic.

Context

This lands in the middle of an already dense Microsoft security period. The August 2026 Patch Tuesday round addressed over 400 vulnerabilities, including one actively exploited by Lazarus Group — and ransomware operators were confirmed exploiting the Windows Task Host flaw in the same cycle. An unauthenticated CVSS-10 RCE against the identity layer is the front-door attack against every downstream Microsoft 365 service tied to that tenant. Organizations that appeared in the Azure data theft campaign reported earlier this month should treat KEV status plus active exploitation as a priority pull on their Entra audit queues — patch window or not.