Microsoft Patches Entra ID RCE Flaw Reportedly Exploited in Attacks
Summary
Microsoft patched maximum-severity CVE-2026-69836, an unauthenticated network code-execution flaw in Entra ID that the article says was exploited in attacks. Microsoft says it is fully mitigated and requires no user action; no exploit code is publicly available.
Key points
- CVE-2026-69836 is a maximum-severity Entra ID flaw involving deserialization of untrusted data, allowing unauthenticated network code execution in low-complexity attacks.
- The article reports the flaw was exploited in attacks, but Microsoft provided no further details about those attacks.
- Microsoft says the flaw is fully mitigated and users do not need to take action; it also says exploit code is not publicly available.
- Microsoft principal security engineer Robert Fitzpatrick discovered the vulnerability.
- Microsoft also addressed critical flaws affecting Azure Arc, Exchange Online, and Azure Managed Instance for Apache Cassandra.
Article Details
- Vulnerability Types
- Deserialization of untrusted data
- Unauthenticated remote code execution
- Severity
- Maximum severity (critical)
- Exploitation Status
- active
- Exploit Availability
- none_reported
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2025-55241In September 2025, it patched another critical Entra ID privilege escalation flaw (CVE-2025-55241) reported by Outsider Security security researcher Dirk-jan Mollema that enabled attackers to gain complete access to theCVE-2026-65770The fourth, tracked as CVE-2026-65770, enabled remote code execution on an Azure Managed Instance for Apache Cassandra.CVE-2026-65801to escalate privileges remotely on Azure Arc (CVE-2026-65816 and CVE-2026-69555) and Exchange Online (CVE-2026-65801).CVE-2026-65816flaws, three of them allowing unauthenticated attackers to escalate privileges remotely on Azure Arc (CVE-2026-65816 and CVE-2026-69555) and Exchange Online (CVE-2026-65801).CVE-2026-69555allowing unauthenticated attackers to escalate privileges remotely on Azure Arc (CVE-2026-65816 and CVE-2026-69555) and Exchange Online (CVE-2026-65801).CVE-2026-69836Microsoft has patched CVE-2026-69836, a maximum-severity flaw in Entra ID that allowed unauthenticated attackers to execute code over the network in low-complexity attacks.
People
Vendors
Products
Azure ArcMicrosoft says the issue has been fully mitigated and no user action is required, while also addressing several other critical flaws across Azure Arc, Exchange Online, and Azure Managed Instance for Apache Cassandra.Azure Managed Instance for Apache CassandraMicrosoft says the issue has been fully mitigated and no user action is required, while also addressing several other critical flaws across Azure Arc, Exchange Online, and Azure Managed Instance for Apache Cassandra.Entra IDMicrosoft has patched CVE-2026-69836, a maximum-severity flaw in Entra ID that allowed unauthenticated attackers to execute code over the network in low-complexity attacks.Exchange OnlineMicrosoft says the issue has been fully mitigated and no user action is required, while also addressing several other critical flaws across Azure Arc, Exchange Online, and Azure Managed Instance for Apache Cassandra.Windows Internet Key Exchange (IKE) Service ExtensionsOn Friday, CISA also tagged a critical-severity remote code execution (RCE) flaw in the Windows Internet Key Exchange (IKE) Service Extensions component as actively exploited.