CVE-2026-69836: RCE in Microsoft Entra ID via Deserialization

Untrusted deserialization in Microsoft Entra ID enables RCE CVSS 10.0. Active exploitation signals reported.

CVE-2026-69836 is an untrusted data deserialization vulnerability in Microsoft Entra ID. It allows an unauthorized attacker to execute remote code (RCE) on systems processing data from malicious actors. Entra ID is the central identity and authentication service for Microsoft 365, Azure, and enterprise applications: RCE at this level compromises the entire user access and session ecosystem.

The official CVSS score is 10.0, critical severity. The flaw was published on 2026-08-20 on NVD. Current signals (recent days) report mentions on social networks related to exploitation campaigns using AiTM proxies to intercept M365 session cookies despite MFA enabled (Mirage2FA): these are unverified signals officially but coherent with the nature and impact of this flaw. The vulnerability represents a complete attack vector against the authentication chain.

Immediate actions: (1) Verify your Entra ID systems are updated to the latest available patch by checking Microsoft Security Updates; (2) Monitor authentication logs for anomalous activity, unauthorized bearer session tokens, and access from unusual locations; (3) Strengthen MFA with phishing-resistant methods (Windows Hello, FIDO2, client certificates); (4) Review conditional access policies and device trust; (5) Audit exposure to proxies or man-in-the-middle in your network topology.

At a glance

What: Untrusted data deserialization in Microsoft Entra ID exposes remote code execution (RCE).
Severity: CVSS 10.0 - Critical. Maximum score.
Affected versions: Not reported in available public data.
Fix: Not reported. Check Microsoft Security Updates official sources.
Status: Published on NVD 2026-08-20. Signals of active exploitation in Mirage2FA-attributed campaigns reported on social networks (unverified officially but coherent with flaw severity).
Action: Apply patch as soon as available, strengthen MFA with phishing-resistant methods, monitor authentication logs and anomalous access, audit network topology for proxy exposure or interception.

Sources: NVD, CVE-2026-69836

← All articles