A Perfect 10 Vulnerability, a Fast Fix, and a Bigger Lesson About Identity

“Identity has moved from a background control to core infrastructure.” That is how Leigh McMullen, a Distinguished Vice President Analyst and Gartner Fellow, recently described the shift now shaping enterprise security. Microsoft just handed security leaders a concrete example of what that shift looks like in practice. In plain terms, a flaw like this one could have let an outsider borrow the same trust Microsoft uses to decide who gets into millions of company accounts.

The company patched a security flaw carrying the highest severity score a vulnerability can receive, a perfect 10 out of 10. The flaw lived inside Entra ID, the identity system that manages sign-in for millions of organizations running on Microsoft 365 and Azure.

That single fact says something about how much the security world has changed. A decade ago, the most dangerous vulnerabilities lived in firewalls or servers sitting inside a company’s own building. Today, the most consequential ones live in the systems that decide who gets to log in.

Entra ID sits behind sign-in for employees at banks, hospitals, airlines, and government agencies around the world. A flaw of this severity inside that system is worth a CISO’s full attention, and it got Microsoft’s full attention too.

What Happened, in Plain Terms

The vulnerability, CVE-2026-69836, involved a coding weakness called deserialization of untrusted data. In other words, part of Entra ID trusted incoming data that it should have inspected more closely, and that gap let an unauthorized attacker execute code over the network. Robert Fitzpatrick, a principal security engineer at Microsoft, is credited with identifying the issue.

Think of Entra ID as a guard checking badges before letting people into a building, except the building holds a company’s email, files, and internal systems, and the badge is a login instead of a plastic card. This flaw was a hole in how the guard processed one specific kind of request. An attacker who found that hole before Microsoft did could have sent Entra ID something that looked like a normal request but secretly carried instructions for Entra ID to carry out. No stolen password was needed. No employee needed to click anything. The hole sat inside the guard’s own rulebook, not inside any single company’s front door.

Security researchers score flaws like this one on a scale from 0 to 10 called CVSS, short for Common Vulnerability Scoring System. A 10 is the highest score on that scale. It goes to flaws that can be triggered remotely, need no special access to start with, and can hand an attacker full control once triggered. Scores that high are rare. Most vulnerabilities disclosed in any given month land well below that line.

One more detail explains why this flaw drew so much attention. Entra ID is not software a company installs on its own servers. Microsoft runs it centrally, and thousands of organizations rely on that same central service to check logins. A flaw in software sitting on one company’s server starts out as that one company’s problem. A flaw in the shared guard checking logins for thousands of companies at once is everyone’s problem until it gets fixed. That is why Microsoft fixed this on its own systems instead of asking each customer to install something.

Microsoft’s advisory briefly listed the flaw as exploited in the wild. On August 21, Microsoft corrected the record and clarified that the vulnerability had not been exploited before the fix went live. No breach, stolen data, or affected company has been publicly linked to this flaw. A company spokesperson told reporters the issue had already been fixed and that customers did not need to take any additional action.

Publicly correcting an advisory is not a comfortable thing for any company to do. It is exactly what a healthy disclosure process looks like when it is working as intended.

That correction is also a useful reminder for security leaders. A determination of “exploited” or “not exploited” depends on the visibility available at the time it is made, not on a guarantee that nothing happened before that. Entra ID customers did not need to install a patch for this particular flaw. Many security teams will still choose to review their own Entra ID sign-in and audit logs from the weeks before the fix, simply to confirm what their own telemetry shows, independent of any single vendor’s statement.

Picture what an attacker could have done with this hole before the fix went in, even though nothing found so far suggests anyone did. They would not have needed to trick an employee or guess a password. They could have quietly picked up the same level of access as the guard itself, which in a company’s world means reading email, opening shared files, and moving through a system while looking like an ordinary, approved login. That is the scenario Microsoft closed off, for every organization on Entra ID, with one fix applied in one place, before it became an incident anywhere.

Why Identity Became the Busiest Door in the Building

This is the bigger pattern behind the CVE number. When one login system verifies access for banks, hospitals, and government agencies all at once, a flaw inside it is never just a technical detail sitting in a spreadsheet. It is a question about how much trust any of us can place in the door we walk through every day without thinking about it. Microsoft answered that question well this time. Staying in that habit is what keeps the answer a good one.

Patches close technical doors quickly. Strengthening the human side of that same door takes longer, and it takes a different kind of preparation.

The Human Side Cannot Be Patched Overnight

Researchers at Harvard Kennedy School’s Belfer Center for Science and International Affairs have been studying this exact gap. Fred Heiding and Alex O’Neill, who research the effect of artificial intelligence on cyber threats, have found that AI tools can cut the cost of running a convincing spear phishing campaign by as much as 99 percent. That means an attacker no longer needs deep technical skill to imitate a colleague, a vendor, or an executive asking for a favor. Identity systems can be patched overnight. People cannot be so easily patched.

That distinction is the lesson sitting underneath this vulnerability. Identity platforms and the people who use them are part of the same system. Strengthening the technology without strengthening the people leaves a gap wide open on the other side of the door.

The encouraging part is that closing that gap does not require reinventing anything. It requires pairing what security teams already do well, patch management, monitoring, and vendor coordination, with a workforce trained to recognize when someone is trying to walk through that same door wearing a different disguise.

What Security Teams Can Do This Week

A few habits go a long way here, and none of them require a large budget or a long timeline.

• Reviewing conditional access policies for Entra ID is one of the highest-value places to start. A quick pass closes a surprising number of paths an attacker might otherwise try, even in a large environment where a full review takes longer than a single afternoon.
• Turning on phishing-resistant multifactor authentication across every account removes one of the simplest entry points attackers rely on. Saving it for a handful of sensitive accounts leaves the rest of the building unlocked.
• Watching sign-in logs for unusual patterns, such as a login from a new location minutes after a login from somewhere else, catches problems early, while they are still small.
• Rotating and limiting privileged administrator accounts shrinks the blast radius even further, so one compromised login cannot reach everything at once.
• None of these steps work in isolation. Attackers who probe identity systems frequently pair the attempt with a phone call, a text message, or a video call built to sound and look like someone the employee already trusts. Training people to pause, verify through a separate channel, and question urgency is the same discipline that security awareness programs practice with employees every day. Strong identity controls and a workforce that spots deception make each other stronger.

Shared Work, Shared Progress

Every disclosure like this one is a chance for the entire security community to get sharper. Microsoft found the flaw, fixed it, and corrected its own advisory in public once the facts changed. Security teams around the world are reading about it right now and checking their own settings this week.

That is coordinated disclosure working close to how it is supposed to work.

Gartner analyst John Watts makes a related point about the current wave of identity and AI-driven attacks: no single control, product, or vendor closes this gap alone. Defenses spread across technology, process, and people are what hold up under pressure. A well-run identity platform and a well-trained workforce are two halves of the same defense, and neither one covers for the other.

Protecting organizations from AI-powered attacks is shared work between vendors, researchers, security teams, and employees. The technology behind identity will keep getting patched. The people behind it deserve the same investment, and every organization that makes both investments makes the work a little easier for the next organization down the line.