CVE-2026-69836: Unauthenticated Remote Code Execution in Microsoft Entra ID via Deserialization of Untrusted Data

CVE-2026-69836 (TL-2026-2107) is a critical-severity software vulnerability scored CVSS 10, first published 2026-08-22 and last reviewed 2026-08-26. It has no confirmed attribution, affects Microsoft Entra ID (formerly Azure Active Directory), references 1 CVE (CVE-2026-69836), maps to 25 MITRE ATT&CK techniques (T1059, T1068, T1078.004), and is covered by 9 detection rules and 30 indicators of compromise.

Key facts for TL-2026-2107

Threat ID
TL-2026-2107
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-08-22
Last reviewed
2026-08-26
Attribution confidence
LOW
Motivation
UNKNOWN
Detection rules
9
Indicators of compromise
30
Updates
2026-08-26 · 5 updates · revalidated 5× · latest source

Microsoft disclosed CVE-2026-69836, a maximum-severity (CVSS 10.0) deserialization-of-untrusted-data flaw (CWE-502) in Entra ID that let an unauthenticated, network-based attacker execute code with no privileges or user interaction. Microsoft's advisory initially marked the CVE's "Exploited" field as "Yes" and four outlets reported confirmed in-the-wild exploitation on 2026-08-21, but Microsoft silently corrected the field to "No" later the same day after The Hacker News queried the company, with Cybersecurity Dive independently corroborating the correction and no explanation given; separately, the research firm watchTowr reported reproducing the vulnerability within minutes of disclosure.

How CVE-2026-69836 works

CVE-2026-69836 is a CVSS 3.1 base-score 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) vulnerability in Microsoft Entra ID, the cloud identity and access-management service (formerly Azure Active Directory) that brokers authentication and authorization for Microsoft 365, Azure, and Dynamics 365/Dynamics CRM Online. NVD and CVE.org classify the root cause as CWE-502, Deserialization of Untrusted Data: per Microsoft's own advisory text, "Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network." Entra ID's backend reconstructed attacker-controlled serialized input into live objects without adequate validation, giving an unauthenticated network attacker arbitrary code execution with no privileges and no user interaction required. The CVSS scope was recorded as Changed (S:C), meaning successful exploitation of the vulnerable component could affect resources beyond its own security scope — consistent with multiple outlets' description of impact extending into Conditional Access, SSO/federation, and token issuance for downstream Microsoft 365, Azure, and Dynamics 365/Dynamics CRM Online tenants. Microsoft credited principal security engineer Robert Fitzpatrick with reporting the flaw.

**Exploitation-status correction — the central finding of this research pass.** On 2026-08-21, four independent outlets (The Cyber Express, Help Net Security, BleepingComputer, The Register) reported that Microsoft's MSRC advisory explicitly marked CVE-2026-69836 as exploited in the wild prior to Microsoft completing its server-side fix. The Hacker News reports that Microsoft's security bulletin originally set the advisory's "Exploited" field to "Yes," but that Microsoft corrected the field to "No" later the same day — after The Hacker News contacted the company for comment — stating plainly "this vulnerability was not exploited in the wild," with a spokesperson adding "there are no additional actions customers need to take." Cybersecurity Dive independently corroborated this timeline, reporting the bulletin was "updated Friday to indicate there was no exploitation," and noting Microsoft provided no explanation for the status change. This directly reframes the hunt-phase characterization of this threat as "confirmed exploited in the wild," which was accurate to the initial advisory language available at ingestion time but is superseded by Microsoft's same-day correction. One secondary write-up, CybersecurityNews, is internally self-contradictory in a way that now makes sense in light of this correction: its headline and body text still describe confirmed in-the-wild exploitation, but a later-inserted note in the same article states "the vulnerability is not currently being exploited in the wild" — consistent with the article being silently edited to reflect Microsoft's correction without a full rewrite, rather than being an unreliable source as initially assessed.

Separately from Microsoft's own exploitation-in-the-wild claim, the security research firm watchTowr reported that it was able to reproduce the vulnerability within minutes of disclosure — indicating the flaw is trivially and reliably exploitable by a capable third party even though (a) Microsoft now states no genuine in-the-wild attacker exploitation occurred, and (b) no exploit code or technical proof-of-concept has been published. Because Entra ID is a fully managed, multi-tenant cloud service, Microsoft applied the fix entirely on its own backend infrastructure under its June 2024 "toward greater transparency" Cloud Service CVE policy (part of the Secure Future Initiative), which commits Microsoft to issuing CVEs for critical, already-patched cloud vulnerabilities purely for customer transparency, independent of whether any customer action is required. The company states no customer action, patch, or configuration change is required or available. CVE-2026-69836 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog as of 2026-08-22, consistent with Microsoft's corrected non-exploitation finding and the absence of a formal U.S. government confirmed-exploitation designation.

Microsoft disclosed no exploit code, no threat-actor identity, no exploitation time window, no affected-tenant count, and no post-exploitation attacker telemetry — and, per the correction, may not have observed any genuine in-the-wild attacker activity at all. No public proof-of-concept is available and no traditional network or file indicators of compromise (IPs, domains, hashes) have been published by Microsoft or any outlet covering the disclosure. FIRST.org EPSS scoring for CVE-2026-69836 registered a comparatively low near-term exploitation-probability score (1.37%, ~69.8th percentile) despite the CVSS 10.0 rating, consistent with the absence of public exploit code and the vulnerability already being closed. Because no attack chain or post-exploitation telemetry was ever disclosed by Microsoft, the MITRE ATT&CK mapping below is grounded in (1) the vulnerability's own confirmed mechanics (CWE-502, the CVSS vector, and the multi-service blast radius Microsoft and secondary outlets describe), (2) the specific *potential*-impact language two secondary outlets independently used to characterize what a successful exploit could achieve, and (3) the specific defensive-audit guidance those same outlets converge on recommending.

On potential impact, CybersecurityNews states that a successful exploit could enable "pivoting into connected cloud workloads, hijacking authentication tokens, and manipulating access policies across an organization's Microsoft ecosystem," and GBHackers separately states impact could extend to "privileged application access" and "downstream SaaS resources." Both outlets are describing a hypothetical consequence of the RCE, not an observed attacker action — consistent with Microsoft's correction that no genuine in-the-wild exploitation occurred — but the specificity of "hijacking authentication tokens" and cross-service "pivoting" independently converges across both sources, so it is treated here as sourced technique-mapping evidence (stolen/forged token abuse for lateral pivot into connected SaaS) rather than invented detail. On defensive guidance, the two outlets converge on: sign-in/audit/application log review, Conditional Access policy audits, Privileged Identity Management/role-assignment audits, service-principal/enterprise-application credential-change audits, and alerting on "risky changes to service principals or applications" — each of which maps to a specific, well-documented Entra ID/Azure AD post-compromise technique, rather than to a speculative or observed attacker campaign.

MITRE ATT&CK techniques used in TL-2026-2107

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1098.003 Additional Cloud Roles; T1484 Domain or Tenant Policy Modification; T1548 Abuse Elevation Control Mechanism

Defense Evasion

T1078.004 Cloud Accounts; T1211 Exploitation for Defense Evasion

Discovery

T1087.004 Account Discovery; T1526 Cloud Service Discovery

Persistence

T1098.001 Additional Cloud Credentials; T1136.003 Create Account; T1556.009 Conditional Access Policies

Initial Access

T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

Lateral Movement

T1210 Exploitation of Remote Services

Credential Access

T1212 Exploitation for Credential Access; T1528 Steal Application Access Token; T1552.005 Unsecured Credentials; T1606.001 Forge Web Credentials: SAML Tokens; T1606.002 Forge Web Credentials

Collection

T1213 Data from Information Repositories

Impact

T1499 Endpoint Denial of Service

lateral-movement

T1550.001 Application Access Token

Resource Development

T1588.006 Obtain Capabilities

Reconnaissance

T1595.002 Active Scanning

Affected products and versions in CVE-2026-69836

  • Microsoft — Entra ID (formerly Azure Active Directory)
    Vulnerable versions: N/A — fully managed multi-tenant cloud service, all tenants prior to Microsoft's server-side fix
    Fixed in: Server-side mitigation applied globally by Microsoft as of the 2026-08-21 advisory; no customer-deployed patch exists or is required
  • Microsoft — Microsoft 365
    Vulnerable versions: N/A — impacted indirectly via dependency on Entra ID for authentication/authorization
    Fixed in: Resolved by Microsoft's Entra ID server-side fix
  • Microsoft — Azure
    Vulnerable versions: N/A — impacted indirectly via dependency on Entra ID for authentication/authorization
    Fixed in: Resolved by Microsoft's Entra ID server-side fix
  • Microsoft — Dynamics 365 / Dynamics CRM Online
    Vulnerable versions: N/A — impacted indirectly via dependency on Entra ID for authentication/authorization
    Fixed in: Resolved by Microsoft's Entra ID server-side fix

Remediation for CVE-2026-69836

Patches

  • None required from customers — Microsoft fully remediated the flaw on Entra ID's own backend infrastructure prior to public disclosure; Entra ID is a fully managed cloud service

Immediate actions

  • No customer action required — Microsoft has already deployed the fix server-side across Entra ID's cloud infrastructure
  • As a precautionary measure (not a response to confirmed exploitation, per Microsoft's 2026-08-21 correction), review Entra ID sign-in logs for anomalous authentication activity in the period leading up to the disclosure
  • Audit Conditional Access policies and Privileged Identity Management (PIM) role assignments for unauthorized changes
  • Audit enterprise application and service principal credential/certificate changes for unauthorized additions

Workarounds

  • None published; Microsoft has not indicated any interim workaround is necessary given the vulnerability is already mitigated server-side

Longer-term hardening

  • Monitor Microsoft Security Response Center (MSRC) advisory updates for CVE-2026-69836, since attribution, an exploitation window (if any), and affected-tenant count remain undisclosed, and the "Exploited" field was itself silently changed once without explanation
  • Maintain continuous auditing of enterprise application and service principal credentials given the identity-provider blast radius inherent to this vulnerability class
  • Track whether CVE-2026-69836 is subsequently added to the CISA Known Exploited Vulnerabilities (KEV) catalog, which it does not appear in as of 2026-08-22

CVEs associated with CVE-2026-69836

CVE-2026-69836

Weaknesses (CWE) in CVE-2026-69836

CWE-502

Timeline of CVE-2026-69836

  • Microsoft's regular August 2026 Patch Tuesday ships fixes for 421 vulnerabilities (62 critical), including a genuinely exploited Windows afd.sys zero-day, CVE-2026-68820 (The Register attributes it to Lazarus Group, not independently corroborated) — unrelated to the Entra ID/Azure batch this threat covers, but the immediate preceding advisory cycle.
  • Robert Fitzpatrick, a Microsoft principal security engineer, reported the Entra ID deserialization flaw that would become CVE-2026-69836.
  • Security leaders (Shane Barney/Keeper Security, Roman Sannikov/iCounter, Alex Wells/Hadrian) publicly disputed Microsoft's 'no customer action required' framing for CVE-2026-69836, urging organizations to independently review privileged-access and sign-in logs for the undisclosed exposure window.
  • BleepingComputer reports CVE-2026-69836 was disclosed alongside several other unauthenticated, network-exploitable Microsoft cloud-service CVEs in the same advisory cycle: CVE-2026-65816/CVE-2026-69555 (Azure Arc unauthenticated remote privilege escalation), CVE-2026-65801 (Exchange Online unauthenticated remote privilege escalation), and CVE-2026-65770 (Azure Managed Instance for Apache Cassandra remote code execution) — all already patched server-side with no customer action required.
  • FIRST.org EPSS scoring for CVE-2026-69836 registered a comparatively low near-term exploitation-probability score (1.37%, ~69.8th percentile) despite the CVSS 10.0 severity rating, consistent with no public PoC and the flaw already being closed.
  • CybersecurityNews' article on the flaw was left internally inconsistent — its headline/body still describe confirmed in-the-wild exploitation while an inserted note states the vulnerability "is not currently being exploited in the wild" — consistent with a partial edit reflecting Microsoft's same-day correction.
  • After The Hacker News contacted Microsoft for comment, Microsoft corrected the advisory's "Exploited" field from "Yes" to "No," stating the vulnerability was not exploited in the wild and offering no explanation for the change; Cybersecurity Dive independently corroborated the correction, reporting the bulletin was "updated Friday to indicate there was no exploitation."
  • Security research firm watchTowr reported reproducing the CVE-2026-69836 vulnerability within minutes of its disclosure, demonstrating reliable exploitability independent of Microsoft's own in-the-wild exploitation claim.
  • The Cyber Express, Help Net Security, BleepingComputer, and The Register independently reported on the advisory, corroborating the initial "confirmed in-the-wild exploitation" claim and the vendor-only fix.
  • Microsoft completed a server-side-only remediation of Entra ID; no customer patching or configuration change was required or made available.
  • Microsoft published the CVE-2026-69836 advisory with maximum CVSS 3.1 score 10.0 and the bulletin's "Exploited" field initially set to "Yes," indicating confirmed in-the-wild exploitation.
  • TheCyberExpress and Cybersecurity News publish coverage still describing CVE-2026-69836 as 'confirmed exploited'; PenLigent's later analysis separately places Microsoft's correction to 'Exploited: No' on this date -- a third distinct reversal date compared to other outlets' 2026-08-21 and CERT-FR/Cybersecurity Dive's 2026-08-24.
  • BleepingComputer reports the precise timestamp of Microsoft's exploitation-status correction as 02:56 EDT on 2026-08-22, and NVD's last-modified timestamp for the CVE record moved to reflect it.
  • As of this research pass, CVE-2026-69836 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, consistent with Microsoft's corrected non-exploitation finding.
  • Per CERT-FR and Cybersecurity Dive, Microsoft's bulletin correction to 'not actively exploited' is dated to 2026-08-24, not 2026-08-21/22 as other outlets reported; CERT-FR updates advisory CERTFR-2026-AVI-1074 the same day to reflect it -- the exact date of Microsoft's reversal is itself inconsistently reported across sources.
  • A later live check of the CISA Known Exploited Vulnerabilities catalog (catalogVersion 2026.08.25, 1,676 entries) reconfirms CVE-2026-69836 is NOT present, directly contradicting a separate outlet claim (Mallory) that CISA had added the CVE to KEV alongside the initial 'exploited' bulletin.
  • NVD's record for CVE-2026-69836 is last modified (2026-08-25T16:08:43Z), reflecting a CISA SSVC rating of no known exploitation.
  • A public GitHub repository (sentinel-aidefense/CVE-2026-69836-EXP) claiming to offer exploit code for CVE-2026-69836 is identified and assessed as an unverified/fabricated PoC -- no real exploit code, no verifiable MSRC reference, an obfuscated tinyurl.com link, and negligible engagement.

Update history for TL-2026-2107

Sources cited for CVE-2026-69836

Threats related to CVE-2026-69836

Detection coverage for TL-2026-2107

As of 2026-08-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2107 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats