Loading today’s stories
Security1 distinct publisher3 min readUpdated
Microsoft says CVE-2026-69836 was abused in the wild and is now fully mitigated on its side, with no customer action required. That leaves nothing to patch and nothing to verify.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
Microsoft disclosed on Thursday a maximum-severity remote code execution flaw in Entra ID, tracked as CVE-2026-69836 and scored CVSS 10.0, which it said has been exploited in the wild [1][2]. In the same breath it said the issue is fully mitigated and that there is no action for users of the service to take [7]. That combination is the story: the service that decides who is who across an enterprise estate was attackable, and the tenants that depend on it had neither visibility into the exposure nor a lever to pull.
The technical description is short. "Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network," Microsoft said in its alert [3]. That class of bug arises when an application turns user-controlled data back into a live object or code structure without validating it, which can yield code execution, denial of service, or access control bypass [4]. In a cloud identity and access management service, formerly Azure Active Directory, that is about as consequential a location as a deserialization bug can occupy [2]. Microsoft credited Principal Security Engineer Robert Fitzaptrick with finding and reporting it [5].
What is not in the advisory is everything an incident responder would want. According to The Hacker News, there are no details on how the flaw was exploited, when exploitation began, whether it is ongoing, or how it was discovered [6]. So the defender's position is: a confirmed in-the-wild exploitation of the identity plane, an unknown window, an unknown actor, and no indicators. Because the fix was applied on Microsoft's side and no customer step exists, there is no patch to deploy, no version to confirm, and no artifact in a tenant that says whether that tenant was among the targets [8].
This is not a patching failure. Server-side mitigation is faster than 300,000 tenants each scheduling a change window, and that speed is a genuine benefit of the model. The cost is that the customer's security programme loses the two things it normally uses to close a finding: a remediation it owns and evidence that the remediation landed. Compensating controls sit above the flaw, not around it, because the vulnerable component is the authentication service itself.
The asymmetry is visible in Microsoft's own month. Earlier in the same month the company patched CVE-2026-68820, a privilege escalation flaw in the Windows Ancillary Function Driver for WinSock scored CVSS 7.0, exploited as a zero-day by the North Korea-linked Lazarus Group as part of the long-running Operation Dream Job campaign [9][10]. The lower-scored bug came with a patch that administrators install, track, and audit. The 10.0 in the identity plane came with a notification [11].
What to watch: whether Microsoft updates the CVE-2026-69836 advisory with an exploitation timeline or any tenant-side indicators [6]; whether sign-in and audit log guidance follows for customers who need to answer a regulator or a board about the exposure window [8]; and whether the "no customer action required" formulation starts appearing on more maximum-severity cloud identity issues, which would make it a category rather than an incident [7].
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
Microsoft on Thursday warned of a maximum-severity security flaw in Entra ID that it said has been exploited in the wild, and noted that no customer action is required.
The vulnerability is tracked as CVE-2026-69836 with a CVSS score of 10.0 and is a remote code execution flaw impacting Microsoft's cloud-based identity and access management service, previously called Azure Active Directory or Azure AD.
Microsoft said in an alert released Thursday: "Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network."
Deserialization flaws occur when an application converts user-controlled data back into an active object or code structure without proper validation, which can lead to code execution, denial-of-service, or access control bypass permitting unauthorized actions.
Microsoft credited Principal Security Engineer Robert Fitzaptrick for discovering and reporting the issue.
As of the report's writing there were no details on how the vulnerability had been exploited, when those efforts began, whether they were still ongoing, or how it was discovered.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Vendor-sourced and internally consistent, but unverifiable and uncorroborated
Every load-bearing fact — the CVSS 10.0 rating, the flaw class, the in-the-wild exploitation, and the completed mitigation — traces to a single Microsoft advisory relayed by one publisher, with the discovery credited to Microsoft's own engineer. The reporting is specific about identifiers and quotes, which raises evidence quality, but it explicitly records the absence of exploitation method, timing, continuation, and discovery detail, and no second source or independent telemetry appears in the cluster.
Exploitation and fix both asserted; scope entirely unquantified
There are two concrete real-world events in the supplied material: a service-wide vendor mitigation for an actively exploited Entra ID flaw, and a customer-installed patch for a Lazarus-exploited WinSock driver flaw in the same month. Both are confirmed occurrences rather than announcements of intent, which supports a measurable score. It stays low because nothing in the cluster indicates how many tenants were touched, how long exploitation ran, or what defenders observed independently.
Severity framing outruns the disclosed substance, but only modestly
The headline claim — maximum severity, exploited in the wild — is attention-grabbing while the supporting substance is thin: no exploitation narrative, no scope, and a reassurance that the matter is closed. The publisher does not embellish; it quotes the advisory and flags the gaps, so the overstatement is mild and originates in the vendor's own framing rather than in the coverage. The countervailing factor is that the unverifiable 'no action required' reassurance arguably understates residual customer uncertainty, which keeps the net gap close to alignment.
Vendor is sole source, sole discoverer, and sole remediator
Microsoft assigned the severity score, detected the flaw through its own principal security engineer, performed the mitigation, declared it complete, and defined the customer obligation as nothing — with no external validator anywhere in the chain. That configuration gives the disclosing party clear reason to bound the narrative to 'serious but already handled', and the supplied coverage passes the framing through without independent challenge.
Clear reporting, but one publisher and one ultimate source
The facts are cleanly and consistently stated with named CVEs, scores, and direct quotations, which supports moderate confidence in what was said. Confidence is capped by structural thinness: a single publisher, a single vendor origin for all substantive claims, self-documented gaps in exploitation detail, and no way for any third party in the supplied material to confirm either the exploitation or the mitigation.
security
Defender's SYSTEM race is back: ShieldBreak PoC says Microsoft's July fix never held6 distinct publishers
security
Six 10.0s in the control plane, and nothing in your patch queue to show for it1 distinct publisher
security
Certighost turns a domain user into a Domain Controller, and the patch is only step one1 distinct publisher
security
Storm-0501's first move is deleting your resource locks, not encrypting your disks1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 20, 2026