[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHFDFLdaYlRnBGTyoBcRc5DnC9pd6Tk-DTTSXqOrjF4c":3},{"article":4,"iocs":56,"watch_terms":64,"solutions":65,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"d19bbde9-a078-4b25-b47d-d99176e750c4","Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution","microsoft-entra-id-flaw-cvss-10-0-exploited-in-wild-allows-remote-code-execution-630ad3","Microsoft on Thursday warned of a maximum-severity security flaw in Entra ID that it said has been exploited in the wild, but noted that no customer action is required. The vulnerability, tracked as CVE-2026-69836 (CVSS score: 10.0), is a case of remote code execution impacting the tech giant's cloud-based identity and access management service. It was previously called Azure Active Directory","Microsoft has issued a warning about a critical remote code execution vulnerability in Microsoft Entra ID, previously known as Azure Active Directory. Tracked as CVE-2026-69836 with a CVSS score of 10.0, the flaw has reportedly been exploited in the wild. Microsoft states that the vulnerability has been fully mitigated and no customer action is required.","Microsoft Entra ID vulnerability (CVSS 10.0) exploited in the wild, allowing RCE.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fmicrosoft-entra-id-flaw-cvss-100.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEid22xatm4tPGWO1VA9heA8p7i0iK4au3br36QORRasXlUO2uY5836xkZe6gywLOId9oHICopC6jZ8J-di4JI9O3CPOSOGsqoOR4Ps4DrEbKCXSXwMxX_wOGo0fY3zaTW4By4nzbY6jldD58kLAlBYfFxMOEeZOglaQu8R0TtT23Q2jLbQjHwJSoS21pqu5\u002Fs1600\u002Fentraid.jpg","2026-08-21T06:06:11+00:00","2026-08-21T08:00:12.379964+00:00",8,[17,20,22,24,27,30],{"name":18,"type":19},"Microsoft Entra ID","product",{"name":21,"type":19},"Azure Active Directory",{"name":23,"type":19},"Azure AD",{"name":25,"type":26},"Microsoft","vendor",{"name":28,"type":29},"Lazarus Group","threat_actor",{"name":31,"type":32},"Operation Dream Job","campaign","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":33,"icon":35,"name":36,"slug":37},null,"Vulnerabilities","vulnerabilities",[39,44,46,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":45},{"id":33,"icon":35,"name":36,"slug":37},{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,61],{"type":58,"value":59,"context":60},"cve","CVE-2026-69836","Microsoft Entra ID vulnerability",{"type":58,"value":62,"context":63},"CVE-2026-68820","Windows Ancillary Function Driver for WinSock vulnerability",[25,18,21],{"controls":66,"vendors":152},[67,95,123],{"slug":68,"name":69,"problem":70,"products":71},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":89,"vendor_name":25,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":96,"name":97,"problem":98,"products":99},"patch-management","Automated patch management","Known holes get closed in days, not months.",[100,107,115],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":96,"product_name":104,"url":105,"description":106},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":124,"name":125,"problem":126,"products":127},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-composable-siem","Abstract Composable SIEM","https:\u002F\u002Fwww.abstract.security\u002Fplatform","SIEM built from separate parts for collection, AI-assisted detection and tiered retention, which can be adopted one at a time.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"guardsix","Guardsix","\u002Fvendor-logos\u002Fguardsix.png","guardsix-siem","Guardsix SIEM","https:\u002F\u002Fguardsix.com\u002Fproduct\u002Fsiem","SIEM with automation, developed and hosted in Europe.",[153],{"slug":89,"name":25,"logo_path":90,"roles":154},[155],"affected",{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":172},"critical-cvss-100-flaw-in-microsoft-entra-id-exploited-in-the-wild","Critical CVSS 10.0 Flaw in Microsoft Entra ID Exploited in the Wild","A maximum-severity remote code execution vulnerability (CVE-2026-69836) in Microsoft Entra ID was actively exploited before a patch was issued, highlighting the persistent danger of identity and access management platform flaws. Because Entra ID serves as a central authentication and authorization hub for countless organizations, a CVSS 10.0 RCE vulnerability in this service carries an exceptionally high blast radius — potentially granting attackers full control over cloud identities and downstream resources. Microsoft applied a server-side mitigation requiring no customer action, but the active exploitation window demonstrates that organizations cannot always rely on vendor-side fixes arriving before threat actors strike. This incident underscores why continuous monitoring of vendor advisories, especially for identity infrastructure, is non-negotiable for modern security programs.",[161,162,163,164,165,166,167,168,169,170,171],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","NIST SP 800-53 SI-2 (Flaw Remediation)","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 IR-4 (Incident Handling)","NIST CSF ID.RA-1 (Asset Vulnerabilities Identified)","NIST CSF DE.CM-7 (Monitoring for Unauthorized Activity)","ISO\u002FIEC 27001 A.12.6.1 – Management of Technical Vulnerabilities","ITIL – Change and Release Management (emergency change procedures)","GDPR Article 32 – Security of Processing (timely response to known vulnerabilities)",{}]