Microsoft has patched a critical remote code execution vulnerability (CVE-2026-69836) in Entra ID, initially reported to have been exploited in the wild.
Entra ID is Microsoft’s cloud identity service, formerly Azure Active Directory, that verifies logins and controls access to Microsoft 365, Azure, and connected third-party apps.
Tracked as CVE-2026-69836, with the maximum CVSS score of 10.0, the vulnerability was discovered by Microsoft Principal Security Engineer Robert Fitzpatrick and could allow an unauthenticated attacker to remotely execute code in Microsoft’s cloud identity service.
“Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network,” Microsoft’s advisory says.
The good news for administrators is that this CVE requires no customer action.
“This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency,” the company noted.
UPDATE (August 24, 2026, 02:15 a.m. ET):
When Microsoft published the CVE-2026-69836 advisory, it stated that the bug was exploited.
Since then, the company changed the exploitation status to “no” and confirmed to Help Net Security that the vulnerability was not exploited in the wild. This article and its headline have been modified to reflect this update.
“We identified and addressed this issue with a fix and released CVE-2026-69836 for greater transparency. There are no additional actions customers need to take,” a company spokesperson stated.