CVE-2026-69836Active Exploitation(microsoft / entra_id)

🚨 Microsoft Entra ID CVSS 10.0 Vulnerability Reported as Actively Exploited A maximum-severity vulnerability affecting Microsoft Entra ID has been disclosed, with Microsoft reportedly indicating that the vulnerability is being actively exploited. Tracked as CVE-2026-69836, the vulnerability involves deserialization of untrusted data and can allow an unauthorized attacker to execute code over a network. * CVE: CVE-2026-69836 * Product: Microsoft Entra ID * Severity: CRITICAL * CVSS: 10.0 — assigned by Microsoft * Weakness: CWE-502 — Deserialization of Untrusted Data * Attack Vector: Network * Authentication Required: None * User Interaction Required: None * Potential Impact: Remote code execution * NVD lists Microsoft Entra as affected and classifies the product as an "Exclusively Hosted Service" * CERT-FR issued advisory CERTFR-2026-AVI-1074 on August 21 * CERT-FR explicitly states that Microsoft reports CVE-2026-69836 as actively exploited ⚠️ Important Clarification: NVD is still enriching the vulnerability record. The current CISA SSVC information displayed through NVD lists exploitation as "none," so it would be premature to claim that CISA independently confirms active exploitation or that the vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog without additional confirmation. ⚠️ Analyst Note: The combination of CVSS 10.0, network accessibility, no authentication requirement and no required user interaction makes this an exceptionally important identity-security vulnerability. Because Entra ID sits at the center of authentication and identity infrastructure for many organizations, defenders should review Microsoft's guidance immediately and assess any recommended remediation or mitigation. Official Sources: NIST NVD: https://nvd.nist.gov/vuln/detail/cve-2026-69836 Microsoft MSRC: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69836 CERT-FR: https://cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1074/ #DDW #Microsoft #EntraID #CVE #CyberSecurity #Vulnerability #ThreatIntelligence

おやすみ前に出ちゃいましたー。CSIRTメンバー注目！CVSS 10.0ですわよ奥様！ 【Microsoft Entra IDにCVSS 10.0。利用企業は何をすべきか】 Microsoft Entra IDで、未認証RCE脆弱性 CVE-2026-69836 が公開された。 CVSS：10.0 対象：Microsoft Entra ID 種別：信頼できないデータのデシリアライズ 攻撃条件：未認証・ネットワーク経由 悪用状況：Exploitation Detected Microsoft側：完全に緩和済み 利用者側：パッチ適用などの作業は不要 重要なのは、 「利用者側の修正作業なし」＝「何もしなくてよい」ではない という点。 今回、根本対策はMicrosoft側で完了しているため、企業側でパッチを適用することはできない。 一方で、実際の悪用が確認されている以上、CSIRTとしては修正より侵害有無の確認を優先したい。 確認対象はEntra IDの監査ログ。 ■ 特権操作 Global Administrator等へのRole Assignment Privileged Role Administratorの追加 Application Administratorの追加 ■ Application / Service Principal 不審なApplication作成 Service Principal作成 Secret / Certificate追加 API Permission追加 Admin Consent付与 Owner追加 ■ 認証・防御設定 Conditional Access変更・削除 MFA / Authentication Method変更 Named Location変更 Security Defaults変更 ■ サインイン 不審IP / 国 Service Principal Sign-in Non-interactive Sign-in 通常と異なるアプリケーション利用 特に注意したいのがService Principalによる永続化。 攻撃者が高権限Applicationを作成し、CredentialやMicrosoft Graph権限を設定した場合、 パスワード変更 MFA再登録 ユーザーセッション失効 だけでは排除できない可能性がある。 したがって、ユーザーアカウントだけを見るのでは不十分。 CSIRTとしての対応方針は以下。 緊急パッチ：不要 Entra Audit Log保全：必要 特権変更確認：推奨 Application / Service Principal調査：重要 Conditional Access変更確認：推奨 全社員パスワード変更：現時点では不要 MicrosoftからのIOC・攻撃期間情報：継続監視 また、 「MFAを有効化しているから安全」 とも言い切れない。 今回の問題はユーザー認証の突破ではなく、Entra IDサービス側のRCE。 MFAやConditional Accessは重要な防御策だが、CVE-2026-69836そのものの根本対策ではない。 今回のようなSaaS脆弱性では、 Patch Managementより、Logging / Detection / Huntingが重要になる。 特にMicrosoftから今後、 攻撃開始時期 IOC 攻撃グループ 具体的な攻撃手法 侵害後の挙動 が公開された場合、過去ログを遡って再調査できる状態にしておきたい。 今回のポイントはこれ。 「Microsoft側で修正済み」と 「自社環境が侵害されていない」は別問題。 CVE-2026-69836は、SaaS時代のインシデント対応で「ログ保全」と「ID変更監視」がなぜ重要なのかを示す事例だと思う。 Source: Microsoft Security Response Center The Hacker News https://thehackernews.com/2026/08/microsoft-entra-id-flaw-cvss-100.html

⚠️ A CVSS 10.0 Entra ID flaw was exploited in the wild. CVE-2026-69836 allows an unauthorized attacker to remotely execute code through unsafe deserialization. Microsoft says the flaw is fully mitigated and no customer action is required. How attackers exploited it remains undisclosed. Read more: https://thehackernews.com/2026/08/microsoft-entra-id-flaw-cvss-100.html

CVE-2026-69836 caught attention for an obvious reason: CVSS 10.0 and Microsoft Entra ID. But the most interesting part of this vulnerability isn’t the number. @Microsoft initially marked it as “Exploited: Yes” before changing the status to “No” and clarifying that there was no confirmed exploitation in the wild. The vulnerability was server-side, so Microsoft was able to remediate it without requiring customers to install a patch. So what should defenders actually do? Look beyond the CVSS score. Review your Entra ID audit and sign-in logs for signs of suspicious activity, including unexpected service principal changes, unusual high-risk sign-ins and suspicious privileged role assignments. We’ve put together practical KQL queries and investigation guidance to help you do exactly that. Read the full article from CQURE: https://cqureacademy.com/blog/cve-2026-69836/

This was not exploited in the wild, but I understand news outlets for jumping on it because Microsoft published it that way... This was discovered by an internal Microsoft security engineer, patched, and CVE published for transparency https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69836 https://t.co/8uW2PhdD6t

🚨 CVE-2026-69836 (CVSS 10.0): Critical RCE in Microsoft Entra ID → Exploited in the wild before disclosure → Microsoft fixed it server-side, no patch needed → Action: hunt Entra logs for suspicious app registrations, new credentials, service principal changes, consent grants Details: https://hubs.la/Q04tR2mn0 #EntraID #Microsoft #ThreatIntel

At least give it a cool name or something. Like Zerologon, LDAPNightmare, etc. Gosh vulnerability disclosure is getting sooo boring… /s 😅😂 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69836

🚨Microsoft parchó la vulnerabilidad crítica CVE-2026-69836 en Entra ID, explotada en ataques contra su plataforma de identidad en la nube. 🔑 El fallo permitía ejecución remota de código sin privilegios. ✅ Ya está totalmente mitigado, sin acción requerida por usuarios. ⚠️ Se suma a otros 4 fallos críticos corregidos en Azure Arc y Exchange Online. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69836

So apparently this extremely severe remote code execution vulnerability in Entra ID (yes, Entra ID) was *not* exploited before Microsoft patched it. At least that's what an update MS published today says. Hmm. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69836

🚨 Microsoft vient de corriger une faille de sécurité qui aurait pu permettre à un hacker d'exécuter du code à distance via le réseau, La vulnérabilité CVE-2026-69836 touchait Microsoft Entra ID, anciennement Azure AD. Microsoft affirme avoir identifié et corrigé la faille avant même la publication du CVE. L'entreprise précise qu'aucune exploitation dans la nature n'a été détectée et qu'aucune action supplémentaire n'est nécessaire pour les clients.

Microsoft Entra ID had a critical RCE flaw and it was already being exploited before anyone knew about it. 🔴 CVE-2026-69836 CVSS: 10.0 - a deserialization vulnerability in Entra ID. Remote, unauthenticated attackers could execute arbitrary code on the identity layer. Entra ID underpins single sign-on and access control for millions of enterprise tenants. Identity infrastructure is the most attractive target in any cloud environment. A compromise at the identity layer provides a direct path into cloud workloads, authentication token hijacking, and access policy manipulation across an entire Microsoft ecosystem. No customer patching is required as Microsoft fixed the vulnerability server-side. The disclosure exists for transparency, giving security teams visibility into threats that touched their environment even though the fix was applied before most organizations knew the flaw existed. Cytex provides continuous monitoring of cloud identity infrastructure and unified visibility across Azure, AWS, and GCP, correlating misconfigurations, entitlements, and vulnerabilities into clear attack paths so security teams can identify anomalous activity and respond before it escalates.

Microsoft đã vá CVE-2026-69836 trong Entra ID, lỗ hổng thực thi mã từ xa được chấm CVSS 10.0, mức cao nhất. Kẻ tấn công chỉ cần truy cập qua mạng, không cần đặc quyền sẵn có hay bất kỳ tương tác nào từ người dùng. Cơ chế nằm ở quá trình deserialization: dữ liệu được chuyển thành cấu trúc để ứng dụng xử lý, nhưng nếu không được kiểm tra đúng cách, dữ liệu bị thao túng có thể trở thành mã độc. Trong một dịch vụ quản lý danh tính như Entra ID, điểm yếu này nằm ở lớp hạ tầng có thể mở đường tới nhiều hệ thống phụ thuộc vào xác thực tập trung. Microsoft cho biết đã phát hiện và sửa lỗi trước khi công bố, đồng thời xác nhận lỗ hổng chưa bị khai thác ngoài thực tế. Việc trạng thái khai thác được sửa từ “Yes” thành “No” chỉ là thay đổi thông tin, nhưng cũng cho thấy đánh giá rủi ro ban đầu có thể thay đổi khi dữ liệu được kiểm chứng. AI đang mở rộng năng lực tìm lỗi, từ lỗ hổng trong Zcash đến các hệ thống dùng hàng trăm tác nhân để xác minh mã yếu. Giá trị mới nằm ở tốc độ phát hiện, còn rủi ro vẫn phụ thuộc vào quyền truy cập, cấu hình và khả năng kiểm chứng.

CVE-2026-69836: a deserialization flaw in Microsoft Entra ID let attackers run arbitrary code remotely, no auth, no user interaction, CVSS 10. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69836 https://t.co/AjgcFx5bBN

🛑 Entra ID : une faille critique a été exploitée, mais vous n’avez rien à patcher Une belle faille avec un score CVSS de 10 sur 10 a été patchée dans le service de gestion des identités de Microsoft. Plus d'infos - https://www.it-connect.fr/entra-id-cve-2026-69836-faille-cvss-10-exploitee/ #infosec #entraid https://t.co/svXa4QH11p

【悪用済み】Entra IDにCVSSスコア10の遠隔コード実行脆弱性。CVE-2026-69836。安全でないデシリアライゼーション。悪用済みだがMS側で修正済みとのこと。 https://securityonline.info/cve-2026-69836-entra-id-rce/

Microsoft Entra ID Remote Code Execution Vulnerability - CVE-2026-69836 👇 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69836 https://t.co/q4zsiLhYAE

CVE-2026-69836 | Entra ID | CVSS 10.0 RCE por deserialización. Sin login. Sin clic. En el servicio que autentica Microsoft 365 y Azure. Microsoft ya lo mitigó en su infraestructura. No hay parche que apliques tú. Lo grave no es “¿ya lo parcheé?”. Es que el plano de identidad de media empresa del mundo puede tener un 10.0 y enterarte después, cuando el vendor decide publicarlo. Revisa logs de Entra, apps enterprise y consentimientos raros. Aunque el CVE no pida acción, el riesgo de identidad sí. #Ciberseguridad #EntraID #CVE #IdentidadDigital #BotBauR

CVE-2026-69836 required no credentials and no user interaction - and affected Microsoft Entra ID. 10.0 out of 10. The maximum possible CVSS score. And this one was in Microsoft Entra ID - the cloud identity platform behind authentication and access across Microsoft 365, Azure, Dynamics and thousands of connected applications. 🔓 Here's what Microsoft disclosed about CVE-2026-69836: The vulnerability was a deserialization of untrusted data flaw in Entra ID. In simple terms: Untrusted network data → unsafe deserialization → remote code execution The CVSS vector tells the rest of the story: Network exploitable Low attack complexity No privileges required No user interaction required High impact to confidentiality, integrity and availability In other words, an attacker did not need a compromised account or a victim clicking a link. Successful exploitation could allow an unauthorized attacker to execute code over the network. That's an especially serious failure mode for an identity platform sitting at the center of access to Microsoft cloud environments. Microsoft credited Principal Security Engineer Robert Fitzpatrick with discovering the vulnerability. There's also an important update: Microsoft initially listed the vulnerability as exploited, but corrected that assessment on August 21 and said it had not been exploited in the wild. The vulnerability affected Microsoft's hosted service, and Microsoft says it has already been fully mitigated. No customer patch or other remediation action is required. And CVE-2026-69836 wasn't the only major Microsoft cloud vulnerability disclosed that week. CVSS 10.0 flaws were also published for Azure Arc, Exchange Online and Azure Managed Instance for Apache Cassandra. The interesting incident-response question isn't just "Was it patched?" It's this: If a CVSS 10.0 vulnerability existed inside your identity provider for another 30 days, what evidence would you actually have to detect exploitation - and what could you do about it? #CyberSecurity #MicrosoftEntra #EntraID #CVE #IdentitySecurity #CloudSecurity #IncidentResponse

@BleepinComputer Pure clickbait. Microsoft has already fully mitigated CVE-2026-69836 on the backend. No action required for admins or users.

Microsoft ontdekt en fixt een zeer gevaarlijke bug in Entra ID Bij de meeste mensen is CVE-2026-69836 volledig onder de radar gebleven. Er is verrassend weinig aandacht aan besteed. Het gaat om een bug met de maximale kwetsbaarheidsscore 10 en een CVSS 3.1 vector van AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Dat betekent geen authenticatie, geen gebruikersinteractie, een lage aanvalscomplexiteit, over het netwerk uitvoerbaar en met volledige impact op vertrouwelijkheid, integriteit én beschikbaarheid. Omdat Entra ID de authenticatie- en autorisatielaag vormt voor een groot deel van onze cloud omgevingen, geeft zo een ongeauthenticeerde RCE de sleutels van een belangrijk deel van ons digitale infrastructuur potentieel in handen van iedereen die over deze exploit beschikt. Dit heeft een score en impact op het niveau van Log4Shell, Shellshock, de XZ supply chain aanval en BlueKeep. En er kraait geen haan naar. Waarom? Omdat Microsoft het probleem zelf meldde om “meer transparant” te zijn, maar eigenlijk weinig technische informatie gaf. Oorspronkelijk meldden ze dat de bug in het wild door hackers werd gebruikt, maar dat draaiden ze nadien terug. Omdat het om SaaS software gaat die Microsoft zelf beheert, hebben ze alles op de achtergrond gepatched en hoef je als eindklant niets te doen. Dat komt goed uit voor Microsoft. Of het voor de veiligheid van hun klanten ook zo is, weet ik niet. Het woord transparantie wordt hier gebruikt als echte doublespeak uit 1984. Microsoft is helemaal niet transparant. De bug is zo ernstig dat ze het risico niet konden nemen om het niet te melden, maar inhoudelijk weten we niets en delen ze niks aan technische details. In naam van de transparantie geeft men geen transparantie. Wordt het niet stilletjes aan tijd om iemand anders de sleutels van ons digitaal koninkrijk te laten bewaken? #EntraID #CVE202669836 #CyberSecurity #CloudSecurity #digitalsovereignty👇 https://www.linkedin.com/posts/janguldentops_entraid-cve202669836-cybersecurity-activity-7497216259701510145-Jk7g