Microsoft Entra ID Deserialization of Untrusted Data — RCE
Deserialization flaw in Microsoft Entra ID allows unauthenticated remote code execution over a network. CVSS 10.0. Actively exploited; added to CISA KEV on August 21, 2026.
- Vendor
- Microsoft
- Product
- Entra ID (formerly Azure Active Directory)
- CVSS
- 10.0
- EPSS (exploit probability)
- 1.5%
- Status
- kev
- Published
Is CVE-2026-69836 being exploited?
Yes. CISA added CVE-2026-69836 to its Known Exploited Vulnerabilities catalog. CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.5% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison
CVE-2026-69836 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-69836 is a deserialization of untrusted data vulnerability in Microsoft Entra ID (formerly Azure Active Directory) that allows an unauthenticated, network-adjacent attacker to execute arbitrary code on the service infrastructure. No credentials or user interaction are required.
Microsoft patched it server-side; customers running Entra ID do not need to apply a separate update. CISA added CVE-2026-69836 to the Known Exploited Vulnerabilities catalog on August 21, 2026, with a federal agency compliance deadline of August 24, 2026 under BOD 26-04.
Affected product: Microsoft Entra ID (cloud service — all tenants prior to server-side remediation)
Patch: Applied by Microsoft to service infrastructure; no customer action required to receive the fix
CISA KEV due date: 2026-08-24 (apply mitigations per vendor instructions or document risk-based justification)
Primary sources: Microsoft MSRC advisory · NVD entry · CISA KEV catalog
Other Microsoft CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-96951 Microsoft Windows Command Injection Vulnerability | [ HIGH ] | 8.8 | 1.5% | |
| CVE-2026-96940 Microsoft Exchange Server privilege escalation via weak authorizationwrite-up | [ HIGH ] | 8.8 | 0.5% | — |
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 2.1% | |
| CVE-2026-85889 Azure AI Foundry missing authentication allows unauthorized privilege escalationwrite-up | [ CRITICAL ] | 10.0 | 0.7% | — |
| CVE-2026-69843 Microsoft Fabric authentication bypass by spoofingwrite-up | [ CRITICAL ] | 10.0 | 0.9% | — |
| CVE-2026-85880 Microsoft Windows ALPC Heap Buffer Overflow Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 3.6% | |
| CVE-2026-81963 Microsoft Windows Update Stack Link-Following Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2026-62916 Authentication Bypass via Alternate Path in Microsoft Entra IDwrite-up | [ CRITICAL ] | 9.1 | 0.9% | — |
