Microsoft has patched a maximum-severity vulnerability within the Entra ID id and entry administration (IAM) platform that has been exploited in assaults.
Previously often known as Azure Energetic Listing (or Azure AD), it’s a cloud-based IAM platform that gives Microsoft 365, Azure, or Dynamics CRM On-line prospects with authentication, coverage enforcement, and safety throughout apps and assets.
Tracked as CVE-2026-69836, this essential safety flaw was found by Microsoft principal safety engineer Robert Fitzpatrick, and it allowed risk actors with no privileges to achieve code execution in low-complexity assaults.
Microsoft says exploit code for CVE-2026-69836 isn’t but obtainable on-line and added that customers needn’t take any motion because the flaw has already been absolutely patched.
“Deserialization of untrusted information in Microsoft Entra ID permits an unauthorized attacker to execute code over a community,” Microsoft said in a safety advisory revealed on Thursday.
“This vulnerability has already been absolutely mitigated by Microsoft. There isn’t any motion for customers of this service to take. The aim of this CVE is to supply additional transparency.”
The corporate did not share any extra data, and a Microsoft spokesperson was not instantly obtainable for remark when BleepingComputer requested for extra particulars on assaults exploiting the CVE-2026-69836 flaw.
Yesterday, Microsoft addressed 4 extra most severity flaws, three of them permitting unauthenticated attackers to escalate privileges remotely on Azure Arc (CVE-2026-65816 and CVE-2026-69555) and Trade On-line (CVE-2026-65801). The fourth, tracked as CVE-2026-65770, enabled distant code execution on an Azure Managed Occasion for Apache Cassandra.
In September 2025, it patched one other essential Entra ID privilege escalation flaw (CVE-2025-55241) reported by Outsider Safety safety researcher Dirk-jan Mollema that enabled attackers to achieve full entry to the Microsoft Entra ID tenant of each firm on the planet.
On Friday, CISA additionally tagged a critical-severity distant code execution (RCE) flaw in the Windows Internet Key Exchange (IKE) Service Extensions component as actively exploited.
Total prevention scores can cover what occurs after preliminary entry. As soon as attackers are utilizing legitimate credentials, prevention drops sharply.
The Blue Report 2026 measures defenses method by method throughout 338 million simulations run in buyer manufacturing environments.
