A maximum-severity remote code execution bug in the identity system behind every Microsoft 365 login got tagged 'exploited in the wild' on Thursday morning — and un-tagged by evening, right after reporters started asking questions.
On Thursday, Microsoft shipped a fix for CVE-2026-69836, a remote code execution bug in Entra ID — the identity service that decides who gets into Microsoft 365, Azure, and every third-party app hanging off a corporate login — and rated it a perfect 10.0 on the CVSS scale. Its own advisory briefly said the bug was already being exploited in the wild. By evening, that line was gone.
No authentication. No user interaction. No special access required. Microsoft's own language for CVE-2026-69836 describes an attacker who can reach across the network and run code inside Entra ID through a flaw in how the service deserializes data — turning attacker-controlled input into live objects without checking what's actually in it first. That's about as bad as an identity-platform bug gets, because Entra ID isn't one app among many. It's the front door to almost everything a Microsoft 365 customer runs.
What CVE-2026-69836 actually lets an attacker do
Deserialization bugs are a specific, well-understood failure mode: a service takes data from outside — a token, a request body, a cached blob — and reconstructs it back into a live object without first checking whether that data is safe to become code. Get it wrong, and an attacker who controls the input effectively controls what the object does when it wakes up. It's the same bug family behind some of the ugliest enterprise RCEs of the last decade, from Java deserialization chains to .NET ViewState attacks. Landing it inside Entra ID means the blast radius isn't a single VM — it's every tenant relying on that identity layer to decide who's allowed in.
Entra ID runs as a Microsoft-operated cloud service — which is exactly why this bug got fixed without customers touching anything. · Unsplash
The exploited tag that vanished
Here's the part that's actually new, and it's not the CVSS score. Microsoft's own security advisory listed CVE-2026-69836 as 'Exploited: Yes' when it published Thursday morning. By the time The Hacker News asked Microsoft to confirm what that meant in practice — who was hit, how it was detected — the company had rewritten the field to 'No,' along with a line stating the vulnerability 'was not exploited in the wild.'
How the exploited tag flipped in one day
Morning, Aug 21
Microsoft publishes the CVE-2026-69836 advisory, rating the bug CVSS 10.0 and marking it 'Exploited: Yes.'
Midday, Aug 21
Security outlets begin reporting on the advisory and asking Microsoft for exploitation details.
Evening, Aug 21
Microsoft updates the advisory to 'Exploited: No,' stating the flaw was fully mitigated server-side with no customer action required.
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take.
Microsoft spokesperson
Two things can be true here. It's genuinely good that Microsoft caught and closed a maximum-severity hole in the system that gates access to its entire cloud stack, and did it without needing millions of admins to schedule downtime. It's also true that flipping an 'actively exploited' label to 'not exploited' on the same day, right after outside reporters started asking questions, is exactly the kind of self-graded disclosure that makes security teams distrust vendor advisories in general. The Register's writeup points out Entra ID controls authentication for practically every corporate Microsoft 365 tenant — Microsoft's own Windows DNS wormable bug and the ongoing ShieldBreak Defender bypass saga already have security teams reading Microsoft's exploitation labels with a raised eyebrow this year.
Should you actually do anything about this
For once, the honest answer is no — not because the bug wasn't serious, but because there's nothing to patch on your end. Entra ID is multi-tenant infrastructure Microsoft controls end to end; the fix already shipped to the service itself, the same way it did for Microsoft's other CVSS 10 patch this month, a pair of bugs in Azure and Teams fixed five days ahead of Patch Tuesday. What's worth doing instead: pull your Entra ID sign-in logs for the past two weeks and look for anomalous service-principal activity or token issuance outside your normal patterns. Microsoft hasn't published indicators of compromise, so you're not hunting a specific signature — you're doing the same baseline review you'd want after any 'we already fixed it, trust us' cloud advisory.
Deserialization bugs like this one let attacker-controlled data turn into running code the moment a service trusts it. · Unsplash
Do I need to patch anything for CVE-2026-69836?
No. Entra ID is a Microsoft-operated cloud service, and Microsoft has already applied the fix on its own infrastructure. There's no client update, agent, or configuration change for customers to install.
What is CVE-2026-69836, in plain terms?
A deserialization vulnerability in Microsoft Entra ID that let an attacker send data over the network that Entra ID would reconstruct into a live object without validating it first — resulting in remote code execution with no login and no user interaction needed.
Was this bug actually exploited in the wild?
Microsoft's advisory said yes when it first published on August 21, 2026, then changed the exploitation status to 'No' later the same day, saying the vulnerability had been fully mitigated. Microsoft hasn't explained the correction in detail.
Who found the bug?
Robert Fitzpatrick, a Microsoft principal security engineer, is credited with discovering and reporting CVE-2026-69836.
Is this related to other Microsoft CVSS 10 bugs disclosed recently?
Not directly — CVE-2026-69836 is a distinct deserialization RCE. But it's the latest in a run of maximum-severity Microsoft cloud bugs disclosed this summer, alongside separate CVSS 10.0 issues in Azure and Teams.
Entra ID sits underneath almost every Microsoft 365 tenant on earth, which is exactly why a bug like this one is worth tracking even when there's no patch button to click. The pattern worth watching isn't this specific CVE — it's how often 'fully mitigated, no action needed' cloud advisories are turning out to need a second look once reporters start asking what actually happened, not unlike how Lazarus hid a Windows zero-day inside fake job offers for five weeks before anyone outside the campaign noticed. Expect that scrutiny to keep growing as more of the stack that used to live on-prem, patchable and auditable by IT teams themselves, moves into services only the vendor can see inside.
