CVE-2026-69836: Microsoft Entra ID Cloud Identity Service Exploited in the Wild; CVSS 10.0 Deserialization RCE Triggers Cross-Tenant Crisis

Microsoft disclosed on 20 August 2026 a deserialization-of-untrusted-data RCE in Entra ID, CVE-2026-69836, CVSS 10.0, confirmed exploited in the wild. No account or privileges required. Microsoft already hot-patched the service.

On 20 August 2026 Microsoft published a max-severity advisory CVE-2026-69836 on the MSRC portal. Cloud IAM service Microsoft Entra ID (formerly Azure Active Directory) has a deserialization-of-untrusted-data flaw. CVSS 10.0/10.0. Attacker needs no existing account and no user interaction; attack is network-reachable. Microsoft confirmed in-the-wild exploitation. This is the second max-severity incident against the same cloud identity fabric after the September 2025 Entra ID privilege-escalation flaw CVE-2025-55241, and the first with an RCE surface.

Incident Overview

CVE-2026-69836 was found internally by Microsoft Principal Security Engineer Robert Fitzpatrick. Per the 20 August Microsoft advisory, the description is: Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network. Entra ID is Microsoft's unified identity fabric for Microsoft 365, Azure, Dynamics 365, and millions of third-party SaaS integrations. A break at the identity layer hits nearly every associated cloud tenant. Microsoft did not disclose attacker identity, start time, attack chain, scope, or customer resources accessed after exploitation.

Technical Details

Deserialization of untrusted data is CWE-502. When a service deserializes objects from an untrusted source without strict type and constructor checks, an attacker can hijack the deserialization call chain (Gadget Chain) and run arbitrary system commands in the affected process context. CVE-2026-69836 CVSS vector: Attack Complexity Low, Privileges Required None, User Interaction None; Integrity, Confidentiality, Availability all High. Score 10.0. eSecurity Planet and others restated Microsoft: no valid account required, no victim click/open/execute required. Low-cost remote weaponization is possible.

Impact Assessment

Risk sits at the identity layer:

• Entra ID is the unified SSO and Conditional Access enforcement point for Microsoft 365, Azure, Dynamics, and Power Platform. Exploitation lets an attacker bypass MFA, modify Conditional Access, issue OAuth consent, and mutate in-tenant service principals and app registrations.
• Arbitrary code inside the Entra ID process enables lateral movement into Azure resources, Exchange Online mailbox reads, and Graph API enumeration of tenant objects.
• Of Microsoft's 22 security fixes on 20 August, 6 scored CVSS 10.0, across Entra ID, Azure SQL Database, Azure Arc, Exchange Online, Azure Managed Instance for Apache Cassandra.

Remediation and Mitigation

Microsoft stated: This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. Managed-cloud CVE: no customer patch, no config change. Security teams still:

• Pull Entra ID audit logs, sign-in logs, and risk logs for the past 30-90 days. Check for anomalous Service Principal changes, anomalous geo logins, issued app secrets, tampered OAuth consent.
• Review Global Administrator, Privileged Role Administrator, Application Administrator, Hybrid Identity Administrator, and other high-privilege roles. Confirm recent role assignments and MFA registration changes came from legitimate sources.
• Revoke suspicious refresh tokens and sessions. Rotate app registration secrets and certificates. Re-review suspicious Conditional Access policies.
• Enable identity risk and service principal anomaly detections in Microsoft 365 Defender / Sentinel. Backtrack Risky sign-in history in Microsoft Entra ID Protection.
• Stand up 24/7 recoverability: export current Entra ID config as a baseline snapshot covering app registrations, service principals, directory roles, and OAuth grants for post-incident rollback.

Disclosure Metadata

Not coordinated disclosure from an independent researcher. Captured internally by Microsoft telemetry and IR, so details are tightly limited. Use subsequent official supplements (Microsoft Security Response Center, Defender for Cloud Apps security blog, Microsoft Security Blog) as follow-on sources. Beyond the Entra ID advisory, track same-day Azure Arc CVE-2026-65816/CVE-2026-69555, Exchange Online CVE-2026-65801, and Azure Managed Instance for Apache Cassandra CVE-2026-65770 as required lateral-check scope.

References

• BleepingComputer: Microsoft warns of max severity Entra ID flaw exploited in attacks
• The Register: Microsoft sounds alarm as perfect-10 Entra ID flaw comes under attack
• eSecurity Planet: Microsoft Patches Entra ID RCE Vulnerability Exploited in Attacks
• IT-Connect: Critical Entra ID Flaw Exploited, but Theres Nothing to Patch
• SecurityWeek: Microsoft Rolls Out 22 Fresh Security Patches