Microsoft Entra ID bug can let attackers run code remotely

Published August 20, 2026 CVE-2026-69836

A critical flaw in Microsoft Entra ID could let an attacker run their own code without ever logging in. Entra ID is the sign-in and identity service that businesses use to control who can access their apps and data.

Severity
CriticalCVSS 3.1 · 10.0
Fix
Not confirmedLast checked on Aug 25, 2026
Weakness
CWE-502Deserialization of Untrusted Data
Exploit likelihood
1.6% in 30 daysEPSS, higher than 74% of known flaws
Affects
Microsoft Entra
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Aug 21, 2026
Federal fix deadline
Aug 24, 2026

How it works

The service accepts specially crafted data and rebuilds it into program instructions instead of just reading it as information, letting an attacker's crafted input run as code on Microsoft's side.

What to do

Admins should watch the Microsoft Entra admin center and Microsoft's security update guide for confirmation the fix is live and for any recommended follow-up account or sign-in review.

Technical details

CVE-2026-69836 is a deserialization-of-untrusted-data flaw (CWE-502) in Microsoft Entra ID, rated CVSS 10.0. NVD's description states an unauthorized attacker can execute code over a network. As a cloud identity service, remediation is server-side and handled by Microsoft rather than through a customer-installed update. No advisory-level detail on the vulnerable component, exploitation prerequisites, or a public proof-of-concept is currently available beyond the NVD record.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source