Microsoft Patches Exploited Flaw in Entra ID Identity Software

Microsoft has patched a maximum-severity deserialization flaw in its Entra ID identity software that was actively exploited. The vulnerability, CVE-2026-69836, allowed an unauthenticated attacker to execute code over a network and access sensitive data.

Shane Barney, chief information security officer at Keeper Security, said the flaw was confirmed exploited in the wild before Microsoft closed it, which means organizations still need to determine whether their environments were compromised during that window.

The patch closes the door on future exploitation but tells us nothing about what came through before it closed. Any security team that sees a confirmed exploitation notice should review access logs right now, not waiting for a second signal, Barney warned.