"Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network," Microsoft said in an alert released Thursday.
CVE-2026-69836: a maximum-severity Entra ID deserialization flaw
Microsoft has posted an advisory for CVE-2026-69836, a remote code execution vulnerability in its cloud-based identity and access management service now known as Microsoft Entra ID. The issue carries a CVSS score of 10.0, the highest possible severity rating. Microsoft noted the service was previously called Azure Active Directory, and credited Principal Security Engineer Robert Fitzaptrick for discovering and reporting the issue.
The technical class: deserialization of untrusted data
The company described the flaw as "Deserialization of untrusted data in Microsoft Entra ID," a class of weakness that arises when an application converts user-controlled data back into an active object or code structure without sufficient validation. Microsoft warned that "this can lead to code execution, denial-of-service, or access control bypass that can permit an attacker to perform unauthorized actions." In short: malformed or hostile serialized data can be turned into active operations by the service, enabling attackers to run code remotely.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadMicrosoft's mitigation and guidance to customers
Microsoft said the vulnerability "has already been fully mitigated by Microsoft" and that "There is no action for users of this service to take." The company also confirmed the flaw "has been exploited in the wild." Beyond those statements, Microsoft said that "As of writing, there are currently no details on how the vulnerability has been exploited, when these efforts began and if they are still ongoing, and how it was discovered."
Related recent activity: a patched WinSock privilege escalation exploited by Lazarus
Redmond last month also patched a separate high-severity privilege escalation defect in Windows Ancillary Function Driver for WinSock, tracked as CVE-2026-68820 and rated CVSS 7.0. Microsoft said that earlier flaw "was exploited as a zero-day by the North Korea-linked Lazarus Group as part of a long-running campaign dubbed Operation Dream Job." The company patched that Windows component before disclosing the connection to the named threat actor and campaign.
What this means for technologists, affected enterprises, and policymakers
- Technologists and security teams: will weigh Microsoft's assertion that the vulnerability is "fully mitigated" against the company's admission that exploitation details are not yet public; they are likely to track technical updates and any later forensic disclosures so they can validate protections in place.
- Affected enterprises and procurement leaders: face a straightforward near-term posture — Microsoft says "There is no action for users of this service to take" — while also needing to monitor for follow-up disclosures about exploitation scope, timing, and indicators of compromise that could require internal review.
- Policymakers and regulators: receive another public example of a cloud identity product being linked to an "exploited in the wild" vulnerability, and a recent adjacent case in which Microsoft tied a Windows driver zero-day to the North Korea-linked Lazarus Group, underscoring how both cloud services and client components have been the subject of active exploitation.
Microsoft's public account leaves two clear, factual pillars: the Entra ID flaw is rated CVSS 10.0 and has been exploited in the wild, and Microsoft says it has fully mitigated the issue and that customers need not act. It also leaves open factual questions the company itself acknowledges — when and how the exploit activity occurred, whether it is ongoing, and the precise details of discovery. Those are the next facts observers will watch for as vendors and defenders seek to close the loop between disclosure, mitigation and forensic clarity.
