# CVE-2026-69836: Unauthenticated Remote Code Execution in Microsoft Entra ID via Deserialization of Untrusted Data

> Microsoft disclosed CVE-2026-69836, a maximum-severity (CVSS 10.0) deserialization-of-untrusted-data flaw (CWE-502) in Entra ID that let an unauthenticated, network-based attacker execute code with no privileges or user interaction. Microsoft's advisory initially marked the CVE's "Exploited" field as "Yes" and four outlets reported confirmed in-the-wild exploitation on 2026-08-21, but Microsoft silently corrected the field to "No" later the same day after The Hacker News queried the company, with Cybersecurity Dive independently corroborating the correction and no explanation given; separately, the research firm watchTowr reported reproducing the vulnerability within minutes of disclosure.

- **Published:** 2026-08-22T00:00:00Z
- **Last reviewed:** 2026-08-26T12:46:31.632Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2107
- **ID:** TL-2026-2107
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-69836

## Description

CVE-2026-69836 is a CVSS 3.1 base-score 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) vulnerability in Microsoft Entra ID, the cloud identity and access-management service (formerly Azure Active Directory) that brokers authentication and authorization for Microsoft 365, Azure, and Dynamics 365/Dynamics CRM Online. NVD and CVE.org classify the root cause as CWE-502, Deserialization of Untrusted Data: per Microsoft's own advisory text, "Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network." Entra ID's backend reconstructed attacker-controlled serialized input into live objects without adequate validation, giving an unauthenticated network attacker arbitrary code execution with no privileges and no user interaction required. The CVSS scope was recorded as Changed (S:C), meaning successful exploitation of the vulnerable component could affect resources beyond its own security scope — consistent with multiple outlets' description of impact extending into Conditional Access, SSO/federation, and token issuance for downstream Microsoft 365, Azure, and Dynamics 365/Dynamics CRM Online tenants. Microsoft credited principal security engineer Robert Fitzpatrick with reporting the flaw.

**Exploitation-status correction — the central finding of this research pass.** On 2026-08-21, four independent outlets (The Cyber Express, Help Net Security, BleepingComputer, The Register) reported that Microsoft's MSRC advisory explicitly marked CVE-2026-69836 as exploited in the wild prior to Microsoft completing its server-side fix. The Hacker News reports that Microsoft's security bulletin originally set the advisory's "Exploited" field to "Yes," but that Microsoft corrected the field to "No" later the same day — after The Hacker News contacted the company for comment — stating plainly "this vulnerability was not exploited in the wild," with a spokesperson adding "there are no additional actions customers need to take." Cybersecurity Dive independently corroborated this timeline, reporting the bulletin was "updated Friday to indicate there was no exploitation," and noting Microsoft provided no explanation for the status change. This directly reframes the hunt-phase characterization of this threat as "confirmed exploited in the wild," which was accurate to the initial advisory language available at ingestion time but is superseded by Microsoft's same-day correction. One secondary write-up, CybersecurityNews, is internally self-contradictory in a way that now makes sense in light of this correction: its headline and body text still describe confirmed in-the-wild exploitation, but a later-inserted note in the same article states "the vulnerability is not currently being exploited in the wild" — consistent with the article being silently edited to reflect Microsoft's correction without a full rewrite, rather than being an unreliable source as initially assessed.

Separately from Microsoft's own exploitation-in-the-wild claim, the security research firm watchTowr reported that it was able to reproduce the vulnerability within minutes of disclosure — indicating the flaw is trivially and reliably exploitable by a capable third party even though (a) Microsoft now states no genuine in-the-wild attacker exploitation occurred, and (b) no exploit code or technical proof-of-concept has been published. Because Entra ID is a fully managed, multi-tenant cloud service, Microsoft applied the fix entirely on its own backend infrastructure under its June 2024 "toward greater transparency" Cloud Service CVE policy (part of the Secure Future Initiative), which commits Microsoft to issuing CVEs for critical, already-patched cloud vulnerabilities purely for customer transparency, independent of whether any customer action is required. The company states no customer action, patch, or configuration change is required or available. CVE-2026-69836 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog as of 2026-08-22, consistent with Microsoft's corrected non-exploitation finding and the absence of a formal U.S. government confirmed-exploitation designation.

Microsoft disclosed no exploit code, no threat-actor identity, no exploitation time window, no affected-tenant count, and no post-exploitation attacker telemetry — and, per the correction, may not have observed any genuine in-the-wild attacker activity at all. No public proof-of-concept is available and no traditional network or file indicators of compromise (IPs, domains, hashes) have been published by Microsoft or any outlet covering the disclosure. FIRST.org EPSS scoring for CVE-2026-69836 registered a comparatively low near-term exploitation-probability score (1.37%, ~69.8th percentile) despite the CVSS 10.0 rating, consistent with the absence of public exploit code and the vulnerability already being closed. Because no attack chain or post-exploitation telemetry was ever disclosed by Microsoft, the MITRE ATT&CK mapping below is grounded in (1) the vulnerability's own confirmed mechanics (CWE-502, the CVSS vector, and the multi-service blast radius Microsoft and secondary outlets describe), (2) the specific *potential*-impact language two secondary outlets independently used to characterize what a successful exploit could achieve, and (3) the specific defensive-audit guidance those same outlets converge on recommending.

On potential impact, CybersecurityNews states that a successful exploit could enable "pivoting into connected cloud workloads, hijacking authentication tokens, and manipulating access policies across an organization's Microsoft ecosystem," and GBHackers separately states impact could extend to "privileged application access" and "downstream SaaS resources." Both outlets are describing a hypothetical consequence of the RCE, not an observed attacker action — consistent with Microsoft's correction that no genuine in-the-wild exploitation occurred — but the specificity of "hijacking authentication tokens" and cross-service "pivoting" independently converges across both sources, so it is treated here as sourced technique-mapping evidence (stolen/forged token abuse for lateral pivot into connected SaaS) rather than invented detail. On defensive guidance, the two outlets converge on: sign-in/audit/application log review, Conditional Access policy audits, Privileged Identity Management/role-assignment audits, service-principal/enterprise-application credential-change audits, and alerting on "risky changes to service principals or applications" — each of which maps to a specific, well-documented Entra ID/Azure AD post-compromise technique, rather than to a speculative or observed attacker campaign.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1098.003 Additional Cloud Roles
- T1556.009 Conditional Access Policies
- T1098.001 Additional Cloud Credentials
- T1078.004 Cloud Accounts
- T1212 Exploitation for Credential Access
- T1528 Steal Application Access Token
- T1550.001 Application Access Token
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1484 Domain or Tenant Policy Modification
- T1211 Exploitation for Defense Evasion
- T1606.001 Forge Web Credentials: SAML Tokens
- T1210 Exploitation of Remote Services
- T1595.002 Active Scanning
- T1548 Abuse Elevation Control Mechanism
- T1552.005 Unsecured Credentials
- T1526 Cloud Service Discovery
- T1213 Data from Information Repositories
- T1136.003 Create Account
- T1499 Endpoint Denial of Service
- T1588.006 Obtain Capabilities
- T1606.002 Forge Web Credentials
- T1087.004 Account Discovery

## Sources

- [Microsoft Says Latest Entra ID Flaw CVE-2026-69836 Exploited](https://thecyberexpress.com/microsoft-entra-id-cve-2026-69836-exploited/)
- [Critical Microsoft Entra ID vulnerability exploited in the wild (CVE-2026-69836)](https://www.helpnetsecurity.com/2026/08/21/microsoft-entra-id-vulnerability-cve-2026-69836/)
- [Microsoft warns of max severity Entra ID flaw exploited in attacks](https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-max-severity-entra-id-flaw-exploited-in-attacks/)
- [Microsoft sounds alarm as perfect-10 Entra ID flaw comes under attack](https://www.theregister.com/cyber-crime/2026/08/21/microsoft-sounds-alarm-as-perfect-10-entra-id-flaw-comes-under-attack/5290925)
- [NVD - CVE-2026-69836 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-69836)
- [Microsoft Security Update Guide - CVE-2026-69836](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69836)
- [CVE Record: CVE-2026-69836](https://www.cve.org/CVERecord?id=CVE-2026-69836)
- [Microsoft Entra ID Remote Code Execution Vulnerability Exploited in the Wild](https://cybersecuritynews.com/entra-id-rce-vulnerability-exploited/)
- [Microsoft Entra ID RCE Flaw Lets Unauthorized Attackers Execute Code Remotely](https://gbhackers.com/microsoft-entra-id-rce-flaw/)
- [Microsoft Entra ID CVE-2026-69836 RCE Exploited in Wild](https://www.spartechsoftware.com/cybersecurity-news/microsoft-entra-id-cve-2026-69836-rce/)
- [FIRST.org EPSS Score - CVE-2026-69836](https://api.first.org/data/v1/epss?cve=CVE-2026-69836)
- [Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution](https://thehackernews.com/2026/08/microsoft-entra-id-flaw-cvss-100.html)
- [Microsoft discloses maximum severity flaw in Entra ID](https://www.cybersecuritydive.com/news/microsoft-maximum-severity-flaw-entra-id-exploitation/828501/)
- [Microsoft patches critical vulnerability in Entra ID following active exploitation](https://www.techzine.eu/news/security/143761/microsoft-patches-critical-vulnerability-in-entra-id-following-active-exploitation/)
- [CVE-2026-69836 - Tenable](https://www.tenable.com/cve/CVE-2026-69836)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2107