Entra ID CVE-2026-69836: a CVSS 10 you can't patch

Microsoft published CVE-2026-69836 on August 20: an unauthenticated remote code execution flaw in Entra ID, scored CVSS 10.0, and flagged in Microsoft's own advisory as Exploited: Yes. There is no patch. There is no KB number, no version to upgrade to, and no reboot window to schedule. Microsoft fixed it in its own service and told customers to do nothing. That is exactly why it deserves an hour of your attention.

What actually happened

The MSRC advisory describes deserialization of untrusted data (CWE-502) in Entra ID that "allows an unauthorized attacker to execute code over a network." The NVD record carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network reachable, low complexity, no privileges, no user interaction, and scope: changed, meaning the blast radius extends past the vulnerable component itself. That combination is how you get a clean 10.0.

Microsoft's threat metadata says Publicly Disclosed: No; Exploited: Yes. The FAQ says the opposite of urgent: "This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency." It was credited internally, to Robert Fitzaptrick at Microsoft, and filed under Microsoft's cloud service CVE transparency program. NVD tags the record exclusively-hosted-service.

One detail worth naming, because it is in the published data and Microsoft has not explained it: the temporal portion of the vector reads E:U/RL:O/RC:C — exploit code maturity unproven — while the threat field says exploited. Microsoft released no timeline, no indicators of compromise, and no affected-tenant guidance. So we have a maximum-severity RCE in the thing that issues your login tokens, an assertion that someone used it, and nothing to check it against.

Why an unpatchable Entra ID flaw matters for your business

Entra ID is not one app. It is the front door to Microsoft 365, to your Azure subscriptions, and to every SaaS tool where somebody clicked "Sign in with Microsoft." A scope-changed RCE in the token issuer is the worst blast radius in your stack, and it is the one piece of infrastructure where your patch process is a press release.

The uncomfortable part is the audit gap. You cannot confirm your tenant was untouched, because Microsoft published nothing to search for. What you can do is make the next one cheaper to survive:

Look at the window anyway. Pull Entra sign-in logs and audit logs for mid-August. You are not hunting an exploit signature you do not have — you are hunting the aftermath: unfamiliar consent grants, new service principals, and role assignments nobody remembers making.

Check app registration credentials. Adding a client secret or certificate to an existing app registration is the standard persistence move after any identity-plane compromise, and it survives every password reset you will ever run. Inventory them, and delete the ones with no owner.

Fix your retention before you need it. Entra's default log retention is short. If your answer to "were we affected in August" is "our logs start in July," that is the finding. Ship sign-in and audit logs to storage you control, with a retention window measured in months.

Assume this repeats. Cloud-service CVEs with no customer action are becoming routine. Conditional access and phishing-resistant MFA do not stop a flaw in the issuer, but they raise the cost of everything an attacker tries next.

Sources: Microsoft Security Response Center, NVD, The Hacker News.