CVE-2026-69836
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
Risk Assessment
An unauthorized attacker can remotely execute code, potentially leading to full system and data compromise.
Recommendation
Apply patches from Microsoft for Microsoft Entra ID and restrict access to the system.
Other vulnerabilities in Microsoft Entra ID
See all- CVE-2026-62916Critical
Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-42901Critical
Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-32208High
A Cross-Site Scripting (XSS) vulnerability in Microsoft Entra ID allows an authorized attacker to perform spoofing attacks over a network. The flaw is caused by improper neutralization of input during web page generation.
Original NVD description (English source)
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS