What is CVE 2026 69836, the maximum severity (CVSS 10.0) Microsoft Entra ID vulnerability caused by unsafe deserialization of untrusted data that allowed unauthenticated, remote attackers with no privileges, user interaction, or special complexity to execute code in the cloud ide

CVE-2026-69836 is a critical Microsoft Entra ID remote-code-execution vulnerability caused by deserialization of untrusted data (CWE-502). Its CVSS 3.1 vector is 10.0: network-reachable, low complexity, no privileges, no user interaction, and high impact to confidentiality, integrity, and availability.

• Microsoft Principal Security Engineer Robert Fitzpatrick is credited with discovering the flaw. It was disclosed on August 20, 2026.
• Reports initially said Microsoft marked it as exploited in the wild. However, on August 21 Microsoft corrected the advisory’s exploitation field from “Yes” to “No.” The best current conclusion is therefore that public evidence does not establish confirmed in-the-wild exploitation.
• Consequently, there is no substantiated public information identifying attackers, victim organizations, attack timeline, or real-world impact. Nor is publicly available exploit code established by the available evidence. Claims otherwise should be treated cautiously.
• Microsoft mitigated the issue on the service side and said Entra customers need take no action.
• The same disclosure period included four other CVSS-10.0 cloud/enterprise issues across Azure SQL Database, Azure Managed Instance for Apache Cassandra, Azure Arc, and Exchange Online, alongside Entra ID.