Zero Day · Security
2026-08-20CriticalSecurity
CVE-2026-69836 · Microsoft Entra ID remote code execution
Deserialization of untrusted data in Microsoft Entra ID could allow an unauthenticated attacker to execute code over the network.
What changed
Microsoft assigns CVSS 10.0. The vulnerability affects the Microsoft-hosted Entra ID service and Microsoft reports it is fully mitigated.
Technical details
- No customer-side patch is required because Microsoft already mitigated the hosted service.
Why it matters
MSRC corrected the exploitation field from Yes to No on 21 August 2026. It must not be presented as a currently exploited zero-day.
Known limitations
- MSRC: Exploited No, Publicly Disclosed No.
- Customer Action Required: No.
- The exploitation correction is informational but materially changes prioritization.
Now check
- Record the provider-side mitigation in the vulnerability register
- Do not create a false endpoint patch requirement
- Monitor the MSRC record for later revisions