CVE-2026-69836: Microsoft Entra ID Remote Code Execution Vulnerability
Published Aug 20, 2026
·Updated
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
Other sources
Microsoft Entra ID Remote Code Execution Vulnerability
— Microsoft
Affected Software
1 affected component
Microsoft Entra ID
Event History
Aug 20, 2026
CVE Published
via Microsoft·02:00 PM
Known Exploited
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·02:00 PM
Affected Software
Updated
via Microsoft·02:00 PM
Description
CVE Published
via MITRE·09:43 PM
Data Sourced
via MITRE·09:43 PM
DescriptionSeverity
Frequently Asked Questions
1
Does exploitation require authentication or user interaction?
No. The vulnerability is described as exploitable by an unauthorized attacker over a network, with no privileges or user interaction required.
2
What is the potential impact of successful exploitation?
Successful exploitation can allow remote code execution. The supplied severity metrics indicate high impact to confidentiality, integrity, and availability, with scope changed.
3
Has this vulnerability been exploited in the wild?
Yes. It is flagged as exploited and is listed in the Known Exploited Vulnerabilities catalog as of 2026-08-20.