www.it-connect.fr
Critical Entra ID Flaw Exploited, but There’s Nothing to Patch
CVE-2026-69836. Behind this identifier lies a vulnerability that enables remote code execution on Entra ID, Microsoft’s cloud identity service. The Redmond-based company says it was exploited in the wild, but that it is now patched. Here’s what we know.
CVE-2026-69836: a critical flaw in Entra ID
On Thursday, August 20, 2026, Microsoft updated its MSRC portal to list this new security flaw. It is described as follows: "Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network".
In general, this kind of weakness works as follows. An application, in this case Entra ID, receives serialized data and then rebuilds it into objects without properly validating the content. An attacker who controls that data can then hijack application processing and cause their own code to run in the context of the vulnerable service.
The vulnerability, assigned a CVSS score of 10 out of 10, was discovered and reported by Robert Fitzpatrick, Senior Security Engineer at Microsoft.
No patch to deploy
Because Entra ID is a service operated by Microsoft directly in the Cloud, there is no update for you to install. "This vulnerability has already been fully mitigated by Microsoft. No action is required from users of this service. The purpose of this CVE is to provide greater transparency.", the company says.
Although no exploit code is available, Microsoft clearly states that the flaw was exploited by cybercriminals. However, the Redmond-based company provides no details about the attacks in question. We do not know:
- Who exploited the flaw, or since when.
- How many tenants were affected, if any...
- What the attackers obtained after exploitation.
- How the malicious activity was detected.
It is not impossible that a report will be published by its security team in the next few days... which would answer these questions.
The CVE-2026-69836 covered in this article did not arrive alone. On August 20, 2026, Microsoft rolled out 22 security fixes across services related to Azure, Entra ID, Exchange Online, Fabric, and the Partner Center. There are even 6 security flaws with a CVSS score of 10 out of 10, including this Entra ID discovery.
For example, there are two elevation-of-privilege issues in Azure Arc (CVE-2026-65816 and CVE-2026-69555) and another in Exchange Online (CVE-2026-65801). Full details are available on the MSRC portal.
Finally, these new security flaws add to an already busy August for Microsoft, following an August 2026 Patch Tuesday with 421 vulnerabilities fixed, including a zero-day already exploited by the North Korean Lazarus group.
