Vulnerability report

CVE-2026-69836

Microsoft Entra ID Remote Code Execution Vulnerability

Microsoft Entra · -

Watch CVE-2026-69836 Browse KEV feed
Severity
CVSS 10.0 · Critical
Confidence
—
Exploit status
PoC available
EPSS
1.4%
First observed
—
Last observed
—

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-69836 is an unauthenticated Microsoft Entra ID Remote Code Execution Vulnerability. Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

Is it exploited?

Previdian records an exploitation-related signal (poc available). This CVE has not been added as a known exploited vulnerability.

Who is affected?

Microsoft Entra -.

What should we do?

Track for updates. Assess relevance to your asset inventory and enrichment workflows.

Overview

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

Microsoft Affected
Microsoft Entra
-
View vendor advisory (opens in new tab)
Published
20 Aug 2026
Exploitation date
—
Attack vector
Remote
Complexity
Low
Privileges
None
User interaction
None

Tags

microsoft

CVE References

Exploitation evidence

Exploitation evidence for this CVE

These signals relate to exploitability. Previdian has not added this CVE as a known exploited vulnerability.

Proof of concept available

GitHub

Recorded 21 Aug 2026

Public scanner or PoC coverage increases practical exploitability.

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
User-Agents
Callback hosts
0
0
0

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

10.0 Critical

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

EPSS

1.4%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Deserialization of Untrusted Data CWE-502

Recent mention · SOCRadar

Top RCE Vulnerabilities

Top RCE Vulnerabilities A remote code execution (RCE) vulnerability is a software flaw that lets an attacker run their own code on a target system from a remote location. Exploiting vulnerabilities like this is now the m

Read full advisory

All Mentions

Recent mention · SOCRadar

Top RCE Vulnerabilities

SOCRadar · 14 Oct 2026

Top RCE Vulnerabilities A remote code execution (RCE) vulnerability is a software flaw that lets an attacker run their own code on a target system from a remote location. Exploiting vulnerabilities like this is now the m

Recent mention · The Hacker News

Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution

The Hacker News · 21 Aug 2026

Microsoft on Thursday warned of a maximum-severity security flaw in Entra ID that it said has been exploited in the wild, but noted that no customer action is required. The vulnerability, tracked as CVE-2026-69836 (CVSS score: 10.0), is a case of remote code execution impacting the tech giant's cloud-based identity and access management service. It was previously called Azure Active Directory

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

sentinel-aidefense/CVE-2026-69836-EXP

github · Created 2026-08-21 22:36:17 UTC · 0 stars · AI assessment 85%

CVE-2026-69836 — Unauthenticated RCE via Entra ID deserialization

Timeline

From disclosure to today

  1. 22:36 UTC

    Public PoC available

    Public proof-of-concept code published

  2. 22:20 UTC

    Added to the Previdian watchlist

    Added to the Previdian curated list for closer monitoring

  3. 21:43 UTC

    CVE published

    Vulnerability disclosed publicly

  4. 22:51 UTC

    CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-69836

Sample API response 
{
  "cve_id": "CVE-2026-69836",
  "confidence": null,
  "cvss_score": 10.0,
  "cvss_estimated": false,
  "epss_score": 0.01368,
  "exploit_status": {
    "exploited_in_the_wild": false,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}