Loading today’s stories
Security1 distinct publisher3 min readUpdated
Microsoft says CVE-2026-69836 is fully mitigated and needs no customer action. It has not said who exploited it, when it started, or how many tenants were touched.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
Microsoft has fixed a remote code execution flaw in Entra ID, tracked as CVE-2026-69836 and carrying the maximum CVSS score of 10.0, which Help Net Security reports was exploited in the wild [1][2]. The flaw sat in the service that verifies logins and controls access to Microsoft 365, Azure and connected third-party apps, which means the compromised component was the one customers do not run, cannot patch and cannot take offline [6].
The technical shape is old and familiar. Microsoft's advisory states that "deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network" [4]. No authentication was required, and the execution happened inside Microsoft's cloud identity service rather than on anything a tenant administrator owns [3]. The finder is credited as Robert Fitzpatrick, a Microsoft Principal Security Engineer, so this was found in-house [5].
Then the part that matters operationally. "This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency," the company said [7]. Read that alongside the exploitation claim and the sequence becomes clear: defenders were told about an exploited maximum-severity identity flaw only after the fix was already complete, so there was never a patch window to manage or miss [9]. There is no configuration change, no version to inventory, no compensating control to stand up [10].
That leaves customers with two things, and neither is under their control. The first is log review, because if code ran unauthenticated inside the identity service, the only tenant-side evidence of consequence would be in sign-in and audit trails and in the downstream systems Entra ID grants access to [6][3]. The second is Microsoft's disclosure practice, which is currently the sole source of scope. Microsoft has not disclosed who was behind the exploitation, when it started, how many organizations were affected, or what the attackers did once inside the vulnerable service [8].
A transparency CVE is better than silence, and Microsoft deserves to be told so plainly. But a CVE without a timeline is not something a security team can act on. Without a start date, no one can bound a log search. Without an affected-tenant count or any indicator of compromise, no one can rule themselves out, and "no action required" is doing double duty as both a reassurance and a full stop [7][8]. For a flaw scored at 10.0 in the system that issues the tokens everything else trusts, that gap is the story [2][6].
The uncomfortable structural point: shared-fate cloud identity means the vendor's incident response is your incident response, and the vendor's disclosure detail sets the ceiling on what your own investigation can even ask. This CVE proves the identity control plane is a live, exploited attack surface, not a theoretical one [1]. Everything after that proof depends on what Microsoft chooses to publish.
What to watch: whether Microsoft follows up with an exploitation timeline, indicators or an affected-tenant estimate, since a start date is the minimum needed to scope a retrospective log hunt [8]. Watch also whether the "CVE issued purely for transparency" pattern becomes routine for Microsoft-operated services, and whether it comes with the detail defenders would need, or stays at the level of this advisory [7].
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
Microsoft has patched a critical remote code execution vulnerability in Entra ID, tracked as CVE-2026-69836, reportedly exploited in the wild.
The vulnerability could allow an unauthenticated attacker to remotely execute code in Microsoft's cloud identity service.
Microsoft's advisory says: "Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network."
The vulnerability was discovered by Microsoft Principal Security Engineer Robert Fitzpatrick.
Entra ID is Microsoft's cloud identity service, formerly Azure Active Directory, that verifies logins and controls access to Microsoft 365, Azure, and connected third-party apps.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Vendor-sourced and specific, but single-outlet and unverified
The core facts are concrete and internally consistent: a tracked CVE identifier, a quoted advisory naming untrusted deserialization and network-reachable code execution, a maximum CVSS rating, a named discoverer, and a quoted mitigation statement. All of it, however, derives from Microsoft's own advisory relayed by a single publisher, and even the exploitation claim is hedged as 'reportedly'. No independent telemetry, researcher writeup, or affected-party account is present, so the evidence is credible in outline and thin in verification.
Exploitation scope withheld
One in-the-wild exploitation event is reported, but the supplied source explicitly states Microsoft did not disclose how many organizations were affected, when exploitation began, or what attackers did once inside. Without any scope, dwell-time or victim data there is no defensible basis to score real-world impact, and inferring breadth from Entra ID's general popularity would be speculation the sources do not support.
Severity framing runs slightly ahead of disclosed evidence
The headline pairing of CVSS 10.0 with in-the-wild exploitation is the most alarming possible framing, yet the disclosed record behind it is one hedged exploitation report, a completed vendor-side fix, and an explicit statement that no customer action is needed. The publisher is measured in tone and flags the missing facts rather than amplifying them, so the overstatement is modest and structural -- driven by the severity score attached to a fix nobody had to apply -- rather than promotional. The undisclosed scope cuts both ways and prevents a larger positive reading.
Vendor is discoverer, fixer and sole narrator
Every material fact originates with a party that has an interest in how the episode reads. Microsoft found the flaw internally through its own principal security engineer, mitigated it in its own service, chose when to publish, framed the CVE as a voluntary transparency gesture, and withheld attribution, timing and victim counts. The reporting outlet relays that account without independent verification, so the disclosure's shape is set by the affected vendor rather than by external scrutiny.
Facts as stated are firm; the picture around them is not
Confidence is limited by structure rather than by contradiction. Nothing in the cluster is disputed, and the technical and advisory details are quoted verbatim, which supports the narrow claims well. But there is one publisher, one upstream source, no independent corroboration of exploitation, and an acknowledged void where scope and attribution should be, so conclusions beyond 'a maximum-severity Entra ID flaw was exploited and fixed server-side' cannot be held with much assurance.
security
A CVSS 10.0 in Entra ID was exploited and fixed without you ever touching it4 distinct publishers
build
ShieldBreak: a Defender-to-SYSTEM PoC that your last patch cycle did not stop1 distinct publisher
security
AWS's answer to prompt-injected agents: orchestrate, never gatekeep1 distinct publisher
build
Kubernetes MCP servers hide the delete tool; hiding is not removing1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 21, 2026