IAM

On August 20, 2026, Microsoft disclosed CVE-2026-69836 — a remote code execution vulnerability in Microsoft Entra ID with a CVSS score of 10.0. The maximum possible. Then it got complicated. What the vulnerability is The root cause is CWE-502: deserialization of untrusted data. Entra ID was processing attacker-supplied input and converting it into active object structures without sufficient validation. The CVSS vector is about as bad as it gets: Network-reachable — no physical or local access needed No authentication required No user interaction — fully automated exploitation possible Low attack complexity High impact on confidentiality, integrity, and availability An attacker who successfully exploited this could execute arbitrary code within Microsoft’s Entra ID infrastructure — meaning potential access to token issuance logic, service principal configurations, and federation trusts. ...

1. The Reality of Active Directory Every AD environment accumulates history. Migrations, acquisitions, staff turnover, legacy applications — they all leave traces. The result is almost always the same: enabled accounts that nobody remembers, service accounts with passwords set years ago, and exceptions that were “temporary” and never cleaned up. This is exactly the low-hanging fruit attackers look for first. Why spend time trying to break into a well-protected account with MFA when there is a 20-year-old enabled account sitting next to it — or a service account with a 5-year-old password and access to something critical? ...

TL;DR September 1, 2026 — Passkeys become default. Users enabled for SMS/Voice are auto-enabled for passkeys and prompted to register. February 1, 2027 — Microsoft-provided SMS and Voice MFA fully retired. No opt-out. Users with no other MFA method will be blocked until they register a passkey. Action required now — Audit who in your tenant uses SMS/Voice and start migrating them to passkeys. 1. What Are Passkeys? Passkeys are phishing-resistant, passwordless credentials that replace both passwords and weak MFA methods like SMS OTP. Instead of a shared secret, they use a cryptographic key pair: ...