Microsoft Warns of Max Severity Entra ID Flaw Exploited in Attacks
Microsoft has patched a maximum-severity vulnerability in the Entra ID identity and access management (IAM) platform that has been exploited in attacks. The flaw, tracked as CVE-2026-69836, allowed threat actors with no privileges to gain code execution in low-complexity …
Intelligence analysis by Llama
Microsoft has patched a critical security flaw in the Entra ID IAM platform that has been exploited in attacks. The flaw, CVE-2026-69836, allowed threat actors to gain code execution with no privileges.
Imagine you have a super important password that keeps your computer safe. But, someone found a way to guess the password and get into your computer without even knowing it. This is like a secret backdoor that hackers can use to get into your computer. Microsoft fixed this problem by patching a security flaw in their Entra ID system.
Analysis
Entra ID Flaw Exploited in Attacks
Microsoft has patched a maximum-severity vulnerability in the Entra ID identity and access management (IAM) platform that has been exploited in attacks. The flaw, tracked as CVE-2026-69836, allowed threat actors with no privileges to gain code execution in low-complexity attacks.
The vulnerability was discovered by Microsoft principal security engineer Robert Fitzpatrick, and it allowed attackers to execute code over a network. Microsoft says exploit code for CVE-2026-69836 is not yet available online, and users don't need to take any action since the flaw has already been fully patched.
The company didn't share any additional information, and a Microsoft spokesperson was not immediately available for comment when BleepingComputer asked for more details on attacks exploiting the CVE-2026-69836 flaw.
Attacks on Azure Arc and Exchange Online
Yesterday, Microsoft addressed four more maximum-severity flaws, three of them allowing unauthenticated attackers to escalate privileges remotely on Azure Arc (CVE-2026-65816 and CVE-2026-69555) and Exchange Online (CVE-2026-65801). The fourth, tracked as CVE-2026-65770, enabled remote code execution on an Azure Managed Instance for Apache Cassandra.
Previous Entra ID Flaw
In September 2025, it patched another critical Entra ID privilege escalation flaw (CVE-2025-55241) reported by Outsider Security security researcher Dirk-jan Mollema that enabled attackers to gain complete access to the Microsoft Entra ID tenant of every company in the world.
CISA's Warning
On Friday, CISA also tagged a critical-severity remote code execution (RCE) flaw in the Windows Internet Key Exchange (IKE) Service Extensions component as actively exploited. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Key points
- Microsoft patched a maximum-severity vulnerability in the Entra ID IAM platform that has been exploited in attacks.
- The flaw, tracked as CVE-2026-69836, allowed threat actors with no privileges to gain code execution in low-complexity attacks.
- Microsoft says exploit code for CVE-2026-69836 is not yet available online, and users don't need to take any action since the flaw has already been fully patched.
- The company addressed four more maximum-severity flaws, three of them allowing unauthenticated attackers to escalate privileges remotely on Azure Arc and Exchange Online.
- A previous Entra ID flaw was patched in September 2025, which enabled attackers to gain complete access to the Microsoft Entra ID tenant of every company in the world.
Microsoft's quick response to patch the Entra ID flaw and their transparency about the vulnerability's existence and exploitation could help prevent further attacks and maintain user trust in their security measures.
The fact that the Entra ID flaw was exploited in attacks before it was patched highlights the importance of timely security updates and the potential consequences of delayed patching, which could lead to further vulnerabilities and attacks.
