The patch that isn't yours: what to do with Entra ID's CVE-2026-69836

On Thursday 20 August Microsoft published a security record with the maximum score: CVE-2026-69836, remote code execution in Entra ID. On Friday the trade press led with "exploited in attacks". That same Friday, with no press note and no headline, Microsoft revised the record. Version 1.1 reads, word for word: "Corrected Exploited to No. This vulnerability was not exploited in the wild. This is an informational change only."

A merely informational change. Fine. But the interesting thing about this CVE is not a checkbox moving, which happens and isn't news. The interesting thing is what remains once the dust settles: a critical vulnerability in the layer that authenticates your entire company, one you did not patch, cannot verify, and that will not show up in any vulnerability report you hand over this quarter. And there is still work here for you. Just not the work you'd expect.

What the record says (and how to read it yourself)

Microsoft's Security Update Guide has a public API — no key, no registration. You don't have to wait for someone to summarise it for you: the primary source is two lines of terminal.

curl -s "https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-69836" \
  | jq '{exploited, customerActionRequired, baseScore, temporalScore,
         revisions: [.revisions[] | {version, revisionDate, unformattedDescription}]}'

What it returns, in short:

If you manage other people's tenants, that's twenty lines of cron, not a threat-intel subscription. And it has one advantage over any summary: the revisions field tells you when the vendor changed its mind, which is precisely the data no headline carries afterwards.

The 10.0 and the small print of the vector

The full vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C. Translated: over the network, low complexity, no credentials, and nobody has to click anything. But what pushes it to a round 10.0 is S:C, scope changed: the impact escapes the vulnerable component. In a multi-tenant identity service, that letter is the genuinely worrying part — far more than the number.

The tail of the vector is what brings the temporal score down to 8.7: E:U (no exploit code on record), RL:O (official fix available) and RC:C (confirmed). Microsoft's exploitability index also marks this CVE as "Exploitation Less Likely". We wrote about that label two days ago in connection with a different flaw, and the caveat still holds: it describes a probability, not a promise. Here it matters less than usual anyway, because the patching deadline isn't yours to set.

A CVE with no version, no KB and no patch

The record's FAQ answers the obvious question — "why are there no links to an update?" — with this sentence: "This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency."

It's worth saying plainly, because this isn't all complaint: this is Microsoft doing the right thing. Since June 2024 it has issued CVEs for critical vulnerabilities in its cloud services even when the customer has nothing whatsoever to do. Before that change, a flaw like this got fixed quietly and nobody outside ever found out. Having a record at all — with its CWE, its vector and its revision history — is a real improvement on the previous state of the world.

The question that is yours: would you have known?

The record doesn't say how long the flaw existed or when it was fixed. It only says it has already been mitigated. That leaves an exposure window of unknown length somewhere in the past, and one very concrete question on the table: if you ever had to answer "were we affected?", what would you answer it with?

With Entra ID's activity logs. And their default retention, per Microsoft's own documentation, is this:

Seven days. That is the horizon of what you can see in the Entra portal on a Free licence, and there are far more such tenants than people assume. And one detail wipes out a lot of people's plan B: retention is not retroactive. The documentation is explicit that when you move from Free to premium you only see what is still inside the seven-day window; anything already expired cannot be recovered. Buying the licence on the day of the scare does not give you back last month.

Let's be clear about what we are not saying: we are not implying anyone was breached through this. The record says there was no exploitation and we have no reason to doubt it. What we are saying is something else, and it holds independently of this particular CVE: the day one of these checkboxes gets corrected in the opposite direction, the answer to "were we affected?" isn't Microsoft's to give. It's yours, split across two portals, with an expiry date almost nobody has checked.

The checklist that does depend on you

None of this is a reaction to this CVE. It is what makes the next one find you in a different position:

And now the honest part, because if we don't say it the first person to read the record carefully will: none of those five points would have stopped CVE-2026-69836. The flaw sat inside Microsoft's service, not in your configuration. No Conditional Access policy stops an unsafe deserialization in the provider's code. This list isn't for preventing the flaw; it's for being able to answer afterwards, which is a different thing and, in practice, the only one that was ever in your hands.

What we are NOT going to do with this

In short

CVE-2026-69836 asks nothing of you. There is no patch to apply, no window to negotiate, no version to chase through the inventory. Which makes it a good day to look at the other thing: how much memory your tenant has, who holds credentials inside it, and how many of the questions a client — or a court — would ask you can answer without phoning anyone. That work doesn't expire when a checkbox is corrected. Our approach to Zero Trust and Microsoft 365 starts exactly there: with what you can prove, not with what you are promised.

Sources (primary, checked on 22 Aug 2026): the CVE-2026-69836 record —scores, vector, CWE-502, the exploited and customerActionRequired fields, the FAQ text and the 1 and 1.1 revision history— in Microsoft's Security Update Guide and its public API (api.msrc.microsoft.com/sug/v2.0); the policy of issuing CVEs for cloud services with no customer action, in "Toward greater transparency: Unveiling Cloud Service CVEs" (MSRC, June 2024); the retention periods and the warning that they are not retroactive, in the Microsoft Entra data retention reference (Microsoft Learn); the 180 days of Audit (Standard) and the one year the default Audit (Premium) policy keeps the AzureActiveDirectory workload for E5 users, in Microsoft Purview's audit retention policies.