Microsoft patches a maximum-severity Entra ID flaw, then walks back its exploitation claim
CVE-2026-69836 scored a perfect 10 on CVSS. Microsoft found it internally and fixed it server-side, but an early advisory wrongly flagged it as already under attack.
A perfect 10 out of 10 on the CVSS scale is rare enough that it deserves a second look even when the story ends better than the headline suggests. CVE-2026-69836 hits Entra ID, the cloud identity service that handles sign-in for millions of business accounts across Microsoft 365. The root cause was a deserialization of untrusted data, a familiar class of bug that here could have let an unauthenticated attacker execute code remotely on the service itself.
Microsoft found this one in house. That matters. Most critical flaws surface after an outside researcher reports them, or worse, after someone catches active exploitation in the wild. This one was discovered and patched server-side by the vendor before any customer had to touch a configuration setting.
The initial advisory did not reflect that calm reality. It listed the "Exploited" field as "Yes," which is exactly the kind of line that sends security teams scrambling to pull Entra ID sign-in logs on a Friday afternoon. On August 21, Microsoft corrected the field to "No" and told Help Net Security directly that no exploitation in the wild had been observed. The company has not said publicly how the classification error happened.
A perfect 10 out of 10 on the CVSS scale is rare enough that it deserves a second look even when the story ends better than the headline suggests.
Because the fix lives entirely on Microsoft's side, there is nothing for administrators to deploy. That does not make the log review pointless. Anyone running Entra ID as their primary identity provider has good reason to check sign-in anomalies around the disclosure window anyway, if only because the first version of the advisory said the worse thing.
Entra ID sits underneath authentication for most of the Microsoft 365 ecosystem in tens of thousands of organizations. A maximum-severity bug there, even one resolved cleanly with zero confirmed damage, is a useful reminder of how much risk concentrates in a single identity provider once an organization has standardized on one.
Deserialization bugs carry a specific reputation in security circles, going back well over a decade to incidents in Java frameworks and .NET remoting libraries that turned an object being read off the wire into arbitrary code execution. The pattern keeps resurfacing because deserialization is convenient: it lets a service reconstruct a complex object from a byte stream without the developer writing custom parsing logic. That convenience is precisely what makes it dangerous the moment untrusted input reaches it, and cloud identity platforms, built for scale and speed, are not immune to reaching for the convenient option.
Based on reporting by Help Net Security.
