Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution
Summary: Microsoft disclosed CVE-2026-69836, a CVSS 10.0 deserialization-of-untrusted-data remote code execution flaw in Entra ID, crediting principal security engineer Robert Fitzpatrick for finding and reporting it. The bulletin initially marked the flaw as exploited in the wild, but on August 21, 2026, after The Hacker News contacted the company, Microsoft corrected the status to "No" and stated the vulnerability was not exploited and required no customer action.
Why it matters: A maximum-severity flaw in the identity service that gates your cloud access was publicly listed as exploited before Microsoft reversed that field, so the record your team may have triaged first was wrong. Microsoft says it fully mitigated the issue and customers need take no action, leaving no independent detail on how the flaw was found or what the fix changed.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Mentions
- CVE-2026-68820CVE-2026-69836
- Related
- CVE-2026-68820: Microsoft Windows Ancillary Function Driver for Win Sock Use-After-Free Vulnerability Known Exploited Vulnerabilities · Aug 11, 2026