By Microsoft disclosed a CVSS 10.0 remote code execution vulnerability in Entra ID last week. The flaw is already patched — server-side, by Microsoft, with no action required from you. Then the company quietly corrected its own bulletin’s “Exploited: Yes” label to “No” after a journalist asked questions. That sequence of events deserves more attention than the CVE itself.
What CVE-2026-69836 Actually Is
The vulnerability — CVE-2026-69836 — stems from a deserialization of untrusted data flaw (CWE-502) deep in the Entra ID backend. Deserialization attacks work by sending a crafted payload to a service endpoint; when the service converts that payload back into live objects, the malicious code embedded in the payload executes in the application’s security context. No authentication. No user interaction. Just a malformed request and a vulnerable endpoint.
That combination pushed the CVSS score to 10.0 — the maximum. Fewer than 0.1% of all CVEs ever reach that ceiling. Microsoft itself has disclosed fewer than a dozen perfect-10 vulnerabilities across its entire product history. When a score like that appears in your identity provider, you pay attention, patched or not.
The “Exploited” Label That Wasn’t
When Microsoft published the August 20 security bulletin, the vulnerability was marked “Exploited: Yes.” Security teams seeing that flag should — and many did — open incidents, pull logs, and start investigating signs of compromise. Then The Hacker News asked Microsoft about the designation. On August 21, the bulletin was corrected to “Exploited: No.”
Microsoft’s statement: “We identified and addressed this issue with a fix and released CVE-2026-69836 for greater transparency. There are no additional actions customers need to take.”
Fair enough. But the correction itself is the story. A CVSS 10.0 in a cloud identity service briefly carried an active-exploitation flag. Organizations that acted on the first version may have burned significant incident response resources. Organizations that saw the corrected version first may have done nothing at all. Both responses were reasonable given the information available at the time. That is not a stable state for critical infrastructure disclosure.
The Governance Gap Nobody Talks About
Here is what “no customer action required” actually means in practice: you cannot independently verify the fix was applied to your tenant, you cannot obtain the patch diff, and you cannot run a retest scan against Microsoft’s infrastructure. Your compliance evidence, if your auditors ask, is Microsoft’s own SOC 2 or ISO 27001 report — not tenant-level proof that CVE-2026-69836 was absent or remediated before you were affected.
This is not specific to Microsoft. It is the tradeoff of managed cloud identity. When your identity provider is a service rather than software you deploy, the attack surface is someone else’s problem to patch — but the governance obligation is still yours to document. A detailed governance gap analysis puts it plainly: SOC 2 auditors are increasingly asking for remediation evidence that cloud providers structurally cannot supply at the tenant level.
This will not get easier. Microsoft recently launched Entra Agent ID, which extends Entra ID to manage service principals for autonomous AI agents. Every agentic workload running on Azure now has an OAuth identity rooted in the same service that carried a CVSS 10.0 vulnerability last week. That is not cause for alarm — it is cause for clear-eyed governance.
What You Should Actually Do
Patching is done. The useful work is in your own logs. Review Entra ID audit and sign-in logs for the window before August 20, looking specifically for:
- Anomalous token issuance — unexpected grants to service principals you do not recognize
- Conditional access policy modifications you did not initiate
- Privilege escalation in role assignments
- Impossible-travel sign-in patterns during the exposure window
For Conditional Access changes specifically, the Microsoft Entra audit log reference covers the full query surface. A quick starting point in Log Analytics:
AuditLogs
| where OperationName == "Update Conditional Access policy"
| where TimeGenerated > ago(30d)
| project TimeGenerated, InitiatedBy, TargetResources, ResultDescriptionIf you find nothing anomalous — document that. The review itself is the compliance artifact. Log the date, the query scope, and the result. That is your due diligence record for auditors who ask how you responded to CVE-2026-69836.
The Bigger Picture
Deserialization flaws are not exotic. OWASP has tracked CWE-502 as a top-10 vulnerability class for nearly a decade. What is relatively new is finding one in the cloud identity infrastructure that serves as the authentication backbone for millions of applications — and in the same service that now issues tokens to autonomous AI agents.
The lesson is not that Entra ID is uniquely risky. The lesson is that moving your identity infrastructure to a managed service transfers patching responsibility but does not transfer governance responsibility. Know what your provider’s disclosure and response commitments are. Know how to review your own logs when a CVSS 10.0 drops. And resist the assumption that “no action required” means “nothing to think about.”
