Microsoft has patched a maximum-severity vulnerability in Entra ID, its cloud identity service used by enterprises — including many crypto exchanges and custodians — to manage employee and system access. Tracked as CVE-2026-69836, the flaw earned a CVSS score of 10.0, the highest possible rating, meaning it could be exploited over the network with no privileges and no user interaction required.
The bug stems from unsafe deserialization: when an application converts incoming data into a usable format without properly validating it first, an attacker can craft malicious input that gets executed as code instead of simply read as data. In Entra ID's case, that meant a remote, unauthenticated attacker could potentially have run arbitrary code within Microsoft's identity infrastructure.
Patched Before the Public Ever Knew
What makes this case unusual is the order of operations. Microsoft identified and fixed the flaw before it published the CVE at all, meaning the vulnerability was never publicly disclosed in an exploitable state. Because Entra ID is a service Microsoft operates and patches centrally, no customer-side update was required — the fix simply rolled out to the backend.
A Microsoft spokesperson said the company “identified and addressed this issue with a fix and released CVE-2026-69836 for greater transparency.” The company's advisory initially listed the flaw's exploitation status as “Yes” before correcting it to “No,” which Microsoft characterized as “an informational change only,” clarifying that the bug was not exploited in the wild before the patch landed.
Related: Volunteer 'Red Team' Races to AI-Proof Bitcoin Software After $130M Hack
Why an Identity Flaw Matters Beyond Microsoft's Walls
Entra ID sits underneath the login flow for a huge share of enterprise software, including internal tools at crypto firms that rely on Microsoft's cloud for staff authentication and access control. A flaw of this severity in that layer is a reminder that the industry's exposure to catastrophic hacks isn't limited to smart contracts and bridges — it extends to the identity and cloud infrastructure providers that crypto companies build on top of. That's the same underlying lesson driving efforts like the volunteer red-teaming push to harden Bitcoin's own codebase after a $130 million hack earlier this year, and it echoes the scramble to contain the fallout after The Sandbox's bridge exploit minted billions in unbacked tokens: severity-10 bugs increasingly hide in the infrastructure layer, not just the application code everyone is watching.
For now, Microsoft says the fix is fully deployed and no action is required from Entra ID customers. The company has not disclosed who discovered the flaw or whether it came through its bug bounty program.
