Loading today’s stories
Security1 distinct publisher2 min readPublished
CVE-2026-69836 scored 10.0 and allowed unauthenticated remote code execution against Microsoft's identity service, and because the fix landed server-side, no customer ever had a version to check or a window to schedule.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
Follow any of these and your For You feed starts watching them — no settings page required.
security
A CVSS 10.0 RCE in Entra ID was exploited in the wild, and there was nothing to patch1 distinct publisher
build
Same-day GPT-5.6 on Azure kills the parity argument, leaving auth and residency to decide1 distinct publisher
security
Levi Strauss lost corporate files through three laptops and no malware1 distinct publisher
security
678,000 French filers and one 9.4: the week's patch-and-notify work, with numbers attached1 distinct publisher
Entra ID runs on Microsoft's infrastructure, not the customer's, so the vulnerable code never shipped into anyone's estate. That one property reorganizes the response. There is no KB number to chase, no build to inventory, and no scanner check that can assert a tenant is clean now and was not before. The Cyber Express reports that Microsoft confirmed the flaw, CVE-2026-69836, was exploited before it was fixed server-side [1], and that it carries a CVSS score of 10.0 for unauthenticated remote code execution against cloud identity infrastructure [2][3]. Both of those figures describe what an attacker could do inside a window whose length has not been published.
Keep the public and the absent apart. Public: the identifier, the score, the vector, and Microsoft's own confirmation that exploitation preceded remediation [1][2][3]. Absent from the material: when exploitation began, when it ended, who was behind it, how many tenants were reached, and whether anything survived the fix [2]. For an on-premises product, a tenant closes some of those gaps with its own telemetry. In a service the vendor operates, the evidence that answers the question mostly sits on the vendor's side, and the part a tenant can examine is capped by the log retention it purchased months ago [4].
Count what is actionable. Four attributes were published about this flaw. None of them converts into a task a tenant can perform on its own systems [3]. The class works that way by construction: the vendor writes the code, runs it, and patches it, while the customer learns about all three after the fact.
Which is why the roundup's closing guidance sits oddly against its lead item. It tells organizations to prioritize strong identity and access controls, rapid vulnerability remediation, and continuous threat monitoring [4]. Rapid remediation has no object here. A severity score has no queue to sort. The advice that still applies to CVE-2026-69836 is the monitoring half, and specifically whether sign-in and audit records for the relevant period still exist somewhere a responder can query.
The shape of this incident, not just its details, is what tenants should plan around. Identity-plane vulnerabilities in operated services will keep arriving already exploited and already closed, disclosed after the fact with a number attached. The only lever a tenant holds in that sequence is its ability to reconstruct what happened in its own directory during a period it did not know was interesting at the time. That lever comes from procurement decisions, retention terms and log export destinations, made well before any advisory lands.
Ranked by verification strength, evidence, and original report placement.
Microsoft confirmed that a critical vulnerability in Entra ID, CVE-2026-69836, was exploited before the flaw was fixed server-side.
CVE-2026-69836 carries a CVSS score of 10.0.
The vulnerability could allow unauthenticated attackers to achieve remote code execution, potentially affecting Microsoft's cloud-based identity infrastructure.
The same roundup advises that organizations should prioritize strong identity and access controls, rapid vulnerability remediation, careful management of AI-agent permissions, secure integrations, human oversight, and continuous threat monitoring.
The Entra ID confirmation was published as one item in a Cyber Express weekly roundup that also covered a New Zealand under-16 social media bill, an INTERPOL operation with 58 arrests across 22 countries, and a Ledger Ethereum app clear-signing fix.
Because the remediation was applied server-side by Microsoft, tenants had no patch to deploy, no version to inventory, and no maintenance window to schedule for CVE-2026-69836.
Distinct publishers with included, body-backed reporting in this cluster.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Two sentences, one outlet
Everything material here — the CVE number, the 10.0, the unauthenticated remote-code-execution vector, the exploited-before-fix sequence — comes from a two-sentence entry in one weekly digest that points elsewhere for detail. We have no Microsoft advisory, no researcher write-up and no second publisher in hand. The facts are internally consistent and specific, which is why this is not lower, but nothing has been checked twice.
Confirmed exploited, scope unknown
Real-world footprint amounts to one asserted fact: attackers used this before it was closed. How many tenants, for how long, by whom, and to what effect are all blank. In a service that fronts identity for a large share of corporate cloud estates, that is a very small amount of measurable reality behind a very large potential one.
Understated by placement
The unusual thing about this story is how quietly it is told. A maximum-score, actively exploited hole in the identity layer that authenticates entire organisations is given the same three lines as a hardware wallet's signing bug and a social media age-verification bill, and the takeaway advises 'rapid vulnerability remediation' for a flaw no customer could remediate. The claims are not inflated; if anything the framing sits below what the facts as reported would carry.
Nothing disclosed either way
We can see who published and who was quoted, and that is all. No sponsorship, ownership, vendor relationship or disclosure arrangement around the Entra ID item is stated anywhere in this reporting, and Microsoft's own framing of the fix is not in front of us to weigh. Reading motive into that silence would be invention.
Thin but coherent
Our confidence is limited by arithmetic more than by doubt: one publisher, one paragraph, no primary advisory, no corroboration. The specifics are precise enough to act on cautiously, and the reasoning about the tenant boundary follows directly from a server-side fix — but a second account, or Microsoft's own, would move this figure substantially in either direction.