Correction, 21 August 2026: an earlier version of this article said CVE-2026-69836 had been exploited in the wild. Microsoft's advisory did say so, and Microsoft has since corrected that field to No. The vulnerability was not exploited. The piece below has been rewritten around what actually happened, which is that the correction has not travelled the way the original did.

On 21 August 2026 Microsoft disclosed CVE-2026-69836, a CVSS 10.0 flaw in Entra ID — the cloud identity service formerly called Azure Active Directory, and the thing that decides who gets into most corporate Microsoft estates.

It is a deserialization of untrusted data issue allowing an unauthorised attacker to execute code over a network. It was reported by Robert Fitzpatrick, a principal security engineer. Microsoft fixed it on its own infrastructure: no update package, no KB, no configuration change, and in Microsoft's words no action for users of the service to take.

All of that is still true. One thing about it is not.

The field that changed

Microsoft's bulletin originally marked the Exploited entry in its exploitability assessment table as Yes.

On the same day, after The Hacker News contacted the company for comment, Microsoft corrected that field to No. The vulnerability was not exploited in the wild.

Between those two states, the first version went everywhere. BleepingComputer, The Register, Help Net Security and a long tail of aggregators all carried it as a maximum-severity identity flaw under active attack — accurately, because that is what the vendor's own advisory said at the time they wrote.

We were about to publish it that way too. This piece exists because we checked the source again before we did.

Why one table cell moved the whole industry

Because Exploited: Yes is not a description. It is an instruction.

It is the field that decides whether something is a Tuesday ticket or a Friday night. It drives KEV listings, emergency change approvals, out-of-hours pages, and the sentence a security lead uses to interrupt a board meeting. Nobody re-derives it; everybody forwards it. That is what makes the machinery efficient and it is what makes a single wrong cell expensive.

And corrections do not inherit the original's velocity. The first version had a headline, a severity and urgency behind it. The correction is a line appended to articles most people have already read, in a story that has stopped being new.

What this does not change

The vulnerability was real and its severity was real. CVSS 10.0 means unauthenticated, remote and total, and the location matters more than the number: Entra ID is not an application, it is the thing applications trust. Every Microsoft 365 sign-in, every Conditional Access decision, every token issued to a SaaS product wired into it depends on that layer holding.

We have written repeatedly about attacks that work by going around the login rather than through it — ADFS signing keys extracted to forge assertions, passkey attack paths in Entra, an OAuth grant with no interactive prompt to attach MFA to. A flaw in the identity provider itself is that category with the intermediate steps deleted. It being unexploited is luck, not architecture.

The part that should still bother you

Strip out the exploitation question and look at the position customers were in.

You did not patch this, because there was nothing on your side to patch. You cannot verify the fix, because you cannot see the service. You could not evaluate the exploitation claim, because you have no logs from the layer where it would have happened. You were told after it was over, and then told something different.

None of that is Microsoft behaving badly. It is the ordinary, correct operation of a managed cloud service, and it is the deal every customer accepted when identity moved off their own hardware. It is worth naming plainly because it is the opposite of how most organisations describe their security posture to an auditor — and because for one day, the only account available of what had happened was wrong, and there was no second source to check it against.

What is actually worth doing

Nothing urgent. But the exercise is free and the answers are useful whenever you next need them:

  • Know where you would look. If Microsoft had said your tenant was affected, which log would you open? Most organisations discover the answer is none.
  • Enumerate service principals and app registrations. Persistence in a Microsoft tenant looks like a legitimate application with more permission than it needs, not a login.
  • Check for credentials added to existing applications. A new certificate or secret on an app nobody has touched in a year is the quiet version of a backdoor.
  • Decide now how you treat a vendor advisory that changes. This one changed within a day. The next one may change after you have already spent a weekend on it.

What is not established

  • Why the field was set to Yes. Microsoft has not explained whether it was an error in the assessment or in publication.
  • Whether any exploitation attempt occurred at all, as distinct from successful exploitation.
  • How many organisations acted on the original version, or what that cost them.
  • Whether the correction reached everyone who read the original. On the evidence of the headlines still standing, no.