CVE-2026-69836

Microsoft Entra ID Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 74th percentile. A vendor fix is available.

CVSS 3.110.0Critical EPSS percentile74th1.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-20Updated 2026-08-25Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check with your IT or admin account whether your organization relies on Microsoft Entra for sign-in, identity, or single sign-on.
Review Microsoft’s official fix status for CVE-2026-69836 on the vendor update guide page linked by Microsoft.
If you have any Entra-related custom integrations, agents, or upstream components, confirm they are not passing through untrusted data to Entra ID flows (and temporarily reduce exposure where possible).
Hunt in your monitoring for unusual authentication patterns and administrative activity around the time this becomes relevant, and tighten alerting for next time.
Document the response, communications, and mitigation steps, and assign an owner to verify remediation completion once Microsoft confirms the fix details for your tenant.

Vendor advisory Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

A Microsoft Entra ID flaw lets an unauthenticated attacker over the network execute commands, and it has reportedly been exploited in real attacks—so a typical small business should act quickly if you rely on Entra ID.

CVE-2026-69836 is a remote code execution weakness in Microsoft Entra where specially crafted network data is incorrectly handled (unauthenticated, no user interaction), resulting in arbitrary command execution within the Entra ID service processing pipeline; reporting indicates exploitation in the wild.

If you're affected

Account access compromise
Service-wide authentication disruption
Potential takeover of Entra-connected systems
Business outage risk

What is it

Think of Microsoft Entra ID as the front desk that decides who gets into your online services. This flaw is like someone finding a way to trick that front desk with specially crafted network messages so it runs commands instead of just processing requests.
Because attackers reportedly used it in real attacks, it can lead to unauthorized access and disruptions that affect logins and connected systems.

Who is affected

This matters to you if your business uses Microsoft Entra ID for user sign-in, authentication, or single sign-on to apps and services. The risk is specifically from an attacker reaching the Microsoft Entra ID service over the network and sending specially crafted data—no login or user action is needed.
In practice, if you rely on Entra ID as your identity provider, you should assume you are potentially affected until Microsoft confirms tenant-side remediation and your admins verify status.

How urgent is it

This is RED because multiple reports say the vulnerability was exploited in real attacks, meaning it’s not just theoretical. Attackers can trigger it remotely over the network without any login or user action, which makes it broadly usable.
Act now to confirm the remediation status from Microsoft and tighten monitoring for authentication and admin activity.

What to do — in detail

Confirm exposure (tenant usage)

Verify Microsoft Entra ID is in use for any of:
- Primary user sign-in for employees/customers
- Single sign-on (SSO) to business apps
- Identity for integrations relying on Entra

Confirm Microsoft’s fix for CVE-2026-69836

Go to Microsoft’s official page for CVE-2026-69836: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69836
Because the finding set indicates there is no clean fixed-version string, treat “fixed version” details as vendor-confirmed information from that page (the exact remediation/rollout details are expected to be described there).
Record:
- What Microsoft states as the fixed status/availability (tenant-side vs. platform-side)
- Any prerequisites or follow-on steps for customers

Temporary containment while remediation is being verified

If your environment has Entra-connected custom applications/integrations, verify they are not inadvertently exposing or forwarding untrusted inputs into Entra-related request flows.
Reduce exposure where feasible by limiting who can change identity-related settings (admin role assignments), and by temporarily tightening conditional access policies if you already have them (without breaking business sign-in).

Detection and monitoring (what to look for)

Review logs for:
- Unusual sign-in success/failure patterns
- New or changed admin roles or high-privilege assignments
- Suspicious authentication from unexpected regions or atypical device/client patterns
- Any spike in authentication or admin actions around the period when Microsoft indicates the issue is being addressed/active
If you have incident response processes, prioritize identity telemetry and admin-change tracking.

Communication and closure

Share the vendor link and your verification status with your IT vendor/internal owner.
When Microsoft indicates the fix is in place for the relevant service/tenant scope, mark the task complete and keep a note of timestamps and evidence.

Technical context

Severity: Critically rated (CVSS 10 is provided in the prompt). Weakness type is CWE-502, which corresponds to unsafe deserialization/incorrect processing of untrusted data.

Mechanism and trigger: The findings describe remote command execution caused by specially crafted data sent over the network that is incorrectly processed by the Microsoft Entra ID service handling those requests. The weakness is reachable in default configuration and requires no authentication and no user interaction per the findings.

Exploitation status: KEV does not list this CVE, but multiple news reports state it has been exploited in the wild. The findings also note no public exploit code is on record, suggesting exploitation may be occurring via attacker tooling not publicly released.

Patch/fix information: A vendor update-guide page exists for CVE-2026-69836, but the findings indicate no clean fixed-version string; exact tenant/service remediation details should be confirmed directly from the Microsoft Security Response Center page (as inferred from the presence of a patch link).

EPSS: A prediction is provided in the findings, but it should not be used to downplay urgency because exploitation reporting takes precedence.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS74th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.5% chance of exploitation activity in the next 30 days, which ranks it in the 74th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 5 days, from the signal feeds we watch.

2026-08-25Analysis publishedMicrosoft Called Its Own Entra ID Bug "Exploited." Then It Didn't.patch available, record updated
2026-08-22Record updated
2026-08-21Record updatedrecord updated
2026-08-20Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US
- entra idSaaS ServiceSaaSSecurity Products / identity-access-mgmt
- Microsoft EntraOn-premOperating Systems / windows

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable