microsoft called this bug 'exploited.' then, a few hours later, it wasn't

A maximum-severity remote code execution bug in the identity system behind every Microsoft 365 login got tagged 'exploited in the wild' on Thursday… Aliteq Priya Nair · Software & Systems Editor

CVE-2026-69836 is a CVSS 10.0 deserialization RCE in Microsoft Entra ID, discovered by Microsoft principal security engineer Robert Fitzpatrick.

It needed no authentication, no user interaction, and no special privileges to exploit over the network.

Microsoft's advisory briefly marked the bug 'Exploited: Yes' on the morning of August 21, 2026, then changed it to 'No' the same day.

Because Entra ID is a Microsoft-run cloud service, the fix was applied server-side — there is no patch for customers to install.

Microsoft has not disclosed who exploited it, when, or what attackers accessed before the fix landed.

I don't think Microsoft lied here — a mislabeled field in a CVSS bulletin is a plausible, boring mistake at the volume Microsoft ships advisories. What bugs me is that we only know about the…

Read the full story

Aliteq microsoft called this bug 'exploited.' then, a few hours later, it wasn't Read the full story on Aliteq