Microsoft Entra ID

On August 20, 2026, Microsoft disclosed CVE-2026-69836 — a remote code execution vulnerability in Microsoft Entra ID with a CVSS score of 10.0. The maximum possible. Then it got complicated. What the vulnerability is The root cause is CWE-502: deserialization of untrusted data. Entra ID was processing attacker-supplied input and converting it into active object structures without sufficient validation. The CVSS vector is about as bad as it gets: Network-reachable — no physical or local access needed No authentication required No user interaction — fully automated exploitation possible Low attack complexity High impact on confidentiality, integrity, and availability An attacker who successfully exploited this could execute arbitrary code within Microsoft’s Entra ID infrastructure — meaning potential access to token issuance logic, service principal configurations, and federation trusts. ...

Found this while browsing: EntraFalcon by Compass Security. A lightweight PowerShell tool that scans your Microsoft Entra ID tenant and generates an interactive HTML report covering privileged objects and role assignments, risky or misconfigured service principals, guest user exposure, Conditional Access gaps, and general identity posture findings. No extra app registration needed — it uses your existing authenticated session via Microsoft Graph PowerShell. That makes it quick to run in environments where creating new app registrations requires approval. ...