Microsoft has confirmed that attackers were actively exploiting a critical remote code execution flaw in Entra ID, the identity platform that underpins sign-in for Microsoft 365, Azure, and a vast number of third-party applications, before the company quietly shut the hole down on its own servers.

The flaw, tracked as CVE-2026-69836, was disclosed on August 20, 2026, with a maximum Critical severity rating. Unlike most headline vulnerabilities, there is no patch for customers to install and no configuration change to make. That is because Entra ID is a fully managed cloud service, and Microsoft says it has already remediated the issue on the back end. The advisory exists purely to inform defenders that malicious activity touched the platform before the fix went live.

A Deserialization Bug With No Login Required

At the root of the problem is a classic and dangerous flaw category: deserialization of untrusted data, tracked under CWE-502. In simple terms, part of Entra ID’s backend accepted specially crafted data objects and processed them without adequately verifying their contents first.

When an attacker submitted malicious serialized data to a vulnerable endpoint, the service could reportedly be coerced into executing arbitrary code, and crucially, without any authentication or user interaction. That combination, unauthenticated remote code execution against an identity provider, is about as severe as cloud vulnerabilities get. It explains both the maximum severity score and the speed with which someone weaponized it in the real world.

Why an Identity-Layer Bug Is Different

Most vulnerabilities compromise a single application or server. A flaw in Entra ID is different because the service sits at the center of authentication for millions of enterprise tenants. Compromising it does not just expose one system, it potentially threatens everything connected to it.

• Attackers who achieve code execution on identity infrastructure could theoretically pivot into connected cloud workloads.
• Stolen or forged authentication tokens could allow impersonation of legitimate users without ever touching their passwords.
• Access policies and conditional-access rules governing an entire organization’s Microsoft ecosystem could potentially be manipulated.

That blast radius is exactly why identity providers are treated as crown-jewel infrastructure, and why a bug like this earns a maximum severity rating even without public proof-of-concept code circulating.

Discovered Through Real Attack Activity, Not a Bug Bounty

What sets CVE-2026-69836 apart from many critical vulnerabilities is how it came to light. Microsoft has explicitly labeled it as exploited in the wild, but there was no public disclosure or independent researcher write-up ahead of the advisory. Instead, the company’s own telemetry and incident response teams appear to have caught genuine attack traffic targeting Entra ID infrastructure and traced it back to this flaw.

Microsoft has not assigned a formal exploitability index score for the bug, listing it simply as “N/A” since the scoring system is designed for on-premises software that customers patch themselves, not a cloud service Microsoft controls end to end. Even so, the confirmation of active exploitation, however brief the exposure window may have been, is the detail security teams should take most seriously.

Part of a Broader Transparency Push

This disclosure fits into what Microsoft has been calling a “Toward Greater Transparency” initiative for cloud service vulnerabilities. Historically, cloud providers have had little obligation to disclose backend security incidents once they were silently fixed, leaving customers unaware that their environment may have been probed or touched by attackers. By publishing advisories like this one, Microsoft is giving security teams a way to check their own logs and incident records for signs that the exploitation activity reached their tenant, even though there is no patch to deploy.

What Security Teams Should Do Now

Because there is no update to install, the practical response looks different than a typical Patch Tuesday scramble. Organizations should treat this primarily as a forensic and monitoring exercise rather than a deployment task.

• Review Entra ID sign-in and audit logs for the affected window for anomalous authentication events, unexpected token issuance, or unusual administrative changes.
• Reassess how much trust is implicitly extended to identity-layer tokens across connected Azure and third-party services, and where additional verification could catch a forged or hijacked session.
• Treat any Entra ID cloud service CVE advisory as a signal worth investigating internally, not just filing away, since these disclosures often mean attacker activity already reached production infrastructure.
• Stay current on Microsoft’s transparency advisories going forward, since this pattern of disclosing after-the-fact cloud exploitation is likely to continue.

The broader lesson for defenders is uncomfortable but important: identity platforms, precisely because of how deeply they are trusted, will keep attracting sophisticated attackers looking for a single point of compromise with outsized returns. Even a provider with Microsoft’s resources can find itself patching a critical flaw only after adversaries have already found and used it.