Microsoft warns of max severity Entra ID flaw exploited in attacks
Microsoft patches critical Entra ID flaw exploited in attacks.
Summary
Microsoft has released a patch for a critical vulnerability (CVE-2026-69836) in its Entra ID identity and access management platform that was actively exploited by attackers. The flaw allowed unprivileged attackers to execute code remotely with low complexity. While Microsoft states the vulnerability is fully mitigated and no user action is required, the company provided limited details on the attacks.
Full text
Microsoft warns of max severity Entra ID flaw exploited in attacks By Sergiu Gatlan August 21, 2026 07:04 AM 0 Microsoft has patched a maximum-severity vulnerability in the Entra ID identity and access management (IAM) platform that has been exploited in attacks. Formerly known as Azure Active Directory (or Azure AD), it is a cloud-based IAM platform that provides Microsoft 365, Azure, or Dynamics CRM Online customers with authentication, policy enforcement, and protection across apps and resources. Tracked as CVE-2026-69836, this critical security flaw was discovered by Microsoft principal security engineer Robert Fitzpatrick, and it allowed threat actors with no privileges to gain code execution in low-complexity attacks. Microsoft says exploit code for CVE-2026-69836 is not yet available online and added that users don't need to take any action since the flaw has already been fully patched. "Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network," Microsoft said in a security advisory published on Thursday. "This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency." The company didn't share any additional information, and a Microsoft spokesperson was not immediately available for comment when BleepingComputer asked for more details on attacks exploiting the CVE-2026-69836 flaw. Yesterday, Microsoft addressed four more maximum severity flaws, three of them allowing unauthenticated attackers to escalate privileges remotely on Azure Arc (CVE-2026-65816 and CVE-2026-69555) and Exchange Online (CVE-2026-65801). The fourth, tracked as CVE-2026-65770, enabled remote code execution on an Azure Managed Instance for Apache Cassandra. In September 2025, it patched another critical Entra ID privilege escalation flaw (CVE-2025-55241) reported by Outsider Security security researcher Dirk-jan Mollema that enabled attackers to gain complete access to the Microsoft Entra ID tenant of every company in the world. On Friday, CISA also tagged a critical-severity remote code execution (RCE) flaw in the Windows Internet Key Exchange (IKE) Service Extensions component as actively exploited. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: Critical RCE flaw in Windows IKE Extension now actively exploitedCritical Zimbra RCE flaw now actively exploited in attacksMax severity SAP Commerce Cloud flaw now targeted in attacksCritical VMware vCenter RCE flaw exploited for reverse SSH accessCISA: Microsoft SharePoint flaw now exploited in ransomware attacks
Indicators of Compromise
- cve — CVE-2026-69836
- cve — CVE-2026-65816
- cve — CVE-2026-69555
- cve — CVE-2026-65801
- cve — CVE-2026-65770
- cve — CVE-2025-55241