Microsoft gave a flaw in Entra ID, the identity service that decides who gets into Microsoft 365 and Azure, the highest score the scale allows: a CVSS base of 10.0. Then, one day after publishing it, the company changed a single field on the record. The vulnerability had not been exploited after all.
The correction matters more than it sounds. An exploited-in-the-wild flag is the switch that moves a bug to the top of every patching queue in the industry.
CVE-2026-69836, which Microsoft titles a Microsoft Entra ID Remote Code Execution Vulnerability, was published on 2026-08-20 through Microsoft's cloud service CVE program. Microsoft's description is one sentence: deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network. The company classifies it as CWE-502, the weakness class where a system trusts incoming data enough to rebuild it into a live object. Microsoft credits Robert Fitzpatrick of Microsoft, so this was found in house.
A maximum score with nothing to patch
The 10.0 comes from the vector Microsoft published, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: reachable over the network, low complexity, no privileges, no user interaction, and impact that crosses out of the vulnerable component into others. That last property, scope change, is what pushes a 9.8 to a 10.0.
Microsoft has published no affected version list, no exploit detail and no detection guidance, and that is deliberate rather than an omission. Entra ID is a service Microsoft runs, so the fix shipped on Microsoft's side. The advisory FAQ states that the vulnerability has already been fully mitigated by Microsoft, that there is no action for users of this service to take, and that the CVE exists to provide transparency. Customer Action Required is recorded as No. Beyond those facts, Microsoft has not described how the flaw could be reached or what an attacker would have gained, and neither will we.
The one field that changed
Revision 1.1, dated 2026-08-21, carries Microsoft's own note: "Corrected Exploited to No. This vulnerability was not exploited in the wild. This is an informational change only." The company's exploitability line now reads Publicly Disclosed: No, Exploited: No, and rates the release Exploitation Less Likely, with a temporal score of 8.7 reflecting an unproven exploit and an official fix.
Independent scoring agrees that this is not a bug anyone is currently throwing at the internet. FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.4 percent, the 69.8th percentile, high enough to notice and nowhere near an actively exploited flaw. The public record sits in the NVD entry.
Nothing to patch, but check your tracker
For defenders the practical work is reconciliation, not remediation. A maximum severity identity bug that briefly reads as exploited propagates into dashboards, risk registers and ticket queues before the correction lands, and corrections travel slower than alarms. We checked the authoritative list ourselves: CISA's Known Exploited Vulnerabilities catalog as published on 2026-08-21, version 2026.08.21 with 1,674 entries, does not list CVE-2026-69836. If your tooling still shows it as known exploited or attaches a remediation deadline to it, the tooling is carrying a stale snapshot of Microsoft's first revision.
The wider point is that Entra ID keeps generating security news for reasons that have nothing to do with unpatched code on your servers. In the past week alone we have covered rogue devices registering into tenants under ordinary looking names and tooling that turns Microsoft 365 token theft into a point and click exercise. Those are the Entra problems a customer can act on. This one Microsoft already closed, and its useful legacy is the reminder that an exploitation flag is a claim like any other, and claims get corrected. Read Microsoft's advisory for the record as it now stands.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.