CISA Adds Actively Exploited Microsoft Entra ID Flaw to KEV Catalog

CISA has added CVE-2026-69836, a critical deserialization of untrusted data vulnerability in Microsoft Entra ID, to its Known Exploited Vulnerabilities catalog on 2026-08-21. The flaw, which carries a CVSS score of 10.0, allows an unauthenticated attacker to execute code remotely over a network. Multiple outlets confirm the vulnerability is being actively exploited in attacks.

The vulnerability affects Microsoft Entra ID, formerly Azure Active Directory. It was discovered by Microsoft Principal Security Engineer Robert Fitzpatrick. SecurityWeek, Help Net Security, and BleepingComputer each report that Microsoft has already mitigated the issue server-side, requiring no action from customers.

Federal agencies must apply the mitigations by 2026-08-24 in accordance with CISA’s BOD 26-04 guidance on prioritizing security updates based on risk. Stakeholders must evaluate each asset’s internet exposure and follow the agency’s forensics triage requirements if applicable. For cloud services, agencies must adhere to BOD 26-04 or discontinue use if mitigations remain unavailable.

The addition reflects confirmed in-the-wild exploitation. CISA’s catalog entry states the vulnerability could allow an unauthorized attacker to execute code. BleepingComputer notes that exploit code is not publicly available, while all three corroborating reports confirm the zero-day nature of the attacks.

Microsoft released the server-side patch as part of a larger update. The fix was included among 22 total patches. No details on the specific attacks have been shared publicly by Microsoft or CISA.

The required action for all affected federal systems remains applying vendor mitigations and ensuring compliance with BOD 26-04. CISA directs organizations to its implementation guidance and forensics triage documents for further instructions. The due date of 2026-08-24 gives agencies three days from catalog addition to remediate.