A CVSS 10.0 in Entra ID was exploited and fixed without you ever touching it

Microsoft disclosed on Thursday a maximum-severity remote code execution flaw in Entra ID, tracked as CVE-2026-69836 and scored CVSS 10.0, which it said has been exploited in the wild ^[1][2]. In the same breath it said the issue is fully mitigated and that there is no action for users of the service to take ^[7]. That combination is the story: the service that decides who is who across an enterprise estate was attackable, and the tenants that depend on it had neither visibility into the exposure nor a lever to pull.

The technical description is short. "Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network," Microsoft said in its alert ^[3]. That class of bug arises when an application turns user-controlled data back into a live object or code structure without validating it, which can yield code execution, denial of service, or access control bypass ^[4]. In a cloud identity and access management service, formerly Azure Active Directory, that is about as consequential a location as a deserialization bug can occupy ^[2]. Microsoft credited Principal Security Engineer Robert Fitzaptrick with finding and reporting it ^[5].

What is not in the advisory is everything an incident responder would want. According to The Hacker News, there are no details on how the flaw was exploited, when exploitation began, whether it is ongoing, or how it was discovered ^[6]. So the defender's position is: a confirmed in-the-wild exploitation of the identity plane, an unknown window, an unknown actor, and no indicators. Because the fix was applied on Microsoft's side and no customer step exists, there is no patch to deploy, no version to confirm, and no artifact in a tenant that says whether that tenant was among the targets ^[8].

This is not a patching failure. Server-side mitigation is faster than 300,000 tenants each scheduling a change window, and that speed is a genuine benefit of the model. The cost is that the customer's security programme loses the two things it normally uses to close a finding: a remediation it owns and evidence that the remediation landed. Compensating controls sit above the flaw, not around it, because the vulnerable component is the authentication service itself.

The asymmetry is visible in Microsoft's own month. Earlier in the same month the company patched CVE-2026-68820, a privilege escalation flaw in the Windows Ancillary Function Driver for WinSock scored CVSS 7.0, exploited as a zero-day by the North Korea-linked Lazarus Group as part of the long-running Operation Dream Job campaign ^[9][10]. The lower-scored bug came with a patch that administrators install, track, and audit. The 10.0 in the identity plane came with a notification ^[11].

What to watch: whether Microsoft updates the CVE-2026-69836 advisory with an exploitation timeline or any tenant-side indicators ^[6]; whether sign-in and audit log guidance follows for customers who need to answer a regulator or a board about the exposure window ^[8]; and whether the "no customer action required" formulation starts appearing on more maximum-severity cloud identity issues, which would make it a category rather than an incident ^[7].