For about a day this week, Microsoft's own security advisory said that a flaw with the highest possible severity score in Entra ID, the identity service that most large organizations sign in through, was being exploited by attackers. On Friday the company changed that. The advisory now says the bug was not exploited in the wild.
The vulnerability is real and it was serious. Tracked as CVE-2026-69836 and published on Thursday, August 20, it carries a CVSS score of 10.0. Microsoft describes it as a deserialization flaw that allowed an attacker with no credentials to run code over the network against Entra ID, the service formerly known as Azure Active Directory. It was found by one of the company's own security engineers.
There is nothing for customers to install. The bug sat in Microsoft's infrastructure, not in software that organizations run themselves, and Microsoft says it had been fully mitigated before the advisory went out. The company says it published the entry for the sake of transparency.
A day of uncertainty
What made Thursday's advisory alarming was a single field. In the table Microsoft uses to describe how likely a flaw is to be abused, the line marked Exploited read Yes. There were no details about who had used the bug, when, or against which tenants.
That left security teams with almost nothing to act on. With a flaw in software on their own servers they can patch, check versions and hunt for known indicators. With a flaw in a hosted identity provider there is no patch to apply and no version to check. The only thing a customer has is the vendor's statement and whatever its own sign in logs happen to show. For roughly 24 hours, the vendor's statement was that the front door of most corporate networks had been under attack.
On August 21 Microsoft changed the field to No and added a note saying the vulnerability had not been exploited. The correction amounts to an admission that the original flag was wrong.
Four more at the top of the scale
The Entra ID entry was one of five maximum severity advisories Microsoft released that day for its cloud services. Two concern Azure Arc and one concerns Exchange Online, and each could have let an attacker with no account raise their privileges remotely. The fifth allowed remote code execution on Azure Managed Instance for Apache Cassandra. As with Entra ID, Microsoft says all of them were fixed on its side, that no exploit code is publicly available, and that customers do not need to do anything.
Flaws like these used to go unannounced, since there was nothing for a customer to patch. Publishing them is a fairly recent practice, and a welcome one. Organizations that have handed their identity system to a cloud provider have every reason to want to know how close a call was. Entra ID has had one before. In September 2025 Microsoft fixed CVE-2025-55241, a privilege escalation bug that could have given an attacker access to the tenant of any organization using the service.
This week's episode does expose a practical gap. When a provider's advisory is the only signal a customer gets, each field in it carries weight. Teams that depend on Entra ID may want to check that they can tell from their own sign in logs whether their tenant was touched, without waiting for the vendor to say so.
