CVE

On August 20, 2026, Microsoft disclosed CVE-2026-69836 — a remote code execution vulnerability in Microsoft Entra ID with a CVSS score of 10.0. The maximum possible. Then it got complicated. What the vulnerability is The root cause is CWE-502: deserialization of untrusted data. Entra ID was processing attacker-supplied input and converting it into active object structures without sufficient validation. The CVSS vector is about as bad as it gets: Network-reachable — no physical or local access needed No authentication required No user interaction — fully automated exploitation possible Low attack complexity High impact on confidentiality, integrity, and availability An attacker who successfully exploited this could execute arbitrary code within Microsoft’s Entra ID infrastructure — meaning potential access to token issuance logic, service principal configurations, and federation trusts. ...

Stumbled across this while browsing: WOFA — Windows Organized Feed for Admins. It is essentially a clean, machine-readable aggregation of Windows security update data sourced from MSRC and CISA KEV. What it gives you at a glance: CVE count per OS version (Windows 10, 11, Server 2016 through 2025) Actively exploited CVEs flagged separately Latest Patch Tuesday build versions per release CISA KEV (Known Exploited Vulnerabilities) flags per version JSON feed and RSS available for automation As of today (August 2026), it is tracking 11,711 CVEs across 13 OS versions, with 153 actively exploited. Windows Server 2025 has CVE-2026-56155 flagged as a KEV — worth checking if your Server 2025 fleet has the July 2026 update applied. ...