CVE-2026-69836

Published Aug 20, 2026

Last updated 2 months ago

Microsoft Entra ID

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-69836 is a remote code execution (RCE) vulnerability identified in Microsoft Entra ID, formerly known as Azure Active Directory. This flaw stems from the deserialization of untrusted data, which enables an unauthorized attacker to execute code over a network. The vulnerability allows an attacker to inject malicious object data that is executed during processing, potentially compromising user accounts, data, or the entire identity platform. Microsoft has fully mitigated this vulnerability on its infrastructure, meaning no customer action is required. While some initial reports suggested the vulnerability had been exploited in the wild, Microsoft later clarified that it was not. The company disclosed the vulnerability for transparency, crediting Principal Security Engineer Robert Fitzpatrick for its discovery.

Description: Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
Source: secure@microsoft.com
NVD status: Analyzed
CNA Tags: exclusively-hosted-service
Products: entra_id

Risk scores

CVSS 3.1

Type: Secondary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

secure@microsoft.com: CWE-502

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:entra_id:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "D09E509F-AFF3-4991-877A-D197388E7AD4",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.