Microsoft Fixes Maximum-Severity Entra ID Security Flaw

Microsoft has patched a maximum-severity vulnerability in Microsoft Entra ID that attackers have already exploited in real-world attacks.

Tracked as CVE-2026-69836, the security flaw could allow an unauthenticated attacker to remotely execute code over a network.

Entra ID flaw required no authentication

CVE-2026-69836 involves the deserialization of untrusted data in Microsoft Entra ID.

According to Microsoft, exploitation required no privileges and no user interaction. The attack also had low complexity, making the vulnerability particularly serious.

Microsoft principal security engineer Robert Fitzpatrick discovered the flaw.

Microsoft confirmed that attackers exploited CVE-2026-69836, but the company has not shared technical details about the attacks or the exploitation method.

Microsoft says customers do not need to act

Microsoft says it has already fully mitigated the vulnerability on its side. Customers do not need to install updates, change configurations, or take any other action.

The company published the CVE to provide additional transparency about the security issue.

Microsoft also says no public exploit code for CVE-2026-69836 is currently available.

However, several details about the attacks remain unknown. Microsoft has not revealed who exploited the flaw, which organizations attackers targeted, how widespread the activity became, or when exploitation first started.

In other security news, CISA recently confirmed that a Windows Task Host flaw is being used in ransomware attacks.

Microsoft is also warning Entra customers about the upcoming February 2027 SMS authentication retirement, while security experts warn that attackers could exploit the Entra passkey rollout through social engineering attacks.

Via BleepingComputer