{"data":{"id":"ff304316-f5e9-47b1-8a7f-0050738d4328","title":"CVE-2026-69836: Microsoft Entra ID Deserialization of Untrusted Data Vulnerability","summary":"Microsoft Entra ID (formerly called Azure Active Directory, which manages user identities and access) has a deserialization of untrusted data vulnerability (a flaw where the software unsafely processes data from untrusted sources, allowing attackers to run malicious code). An attacker could exploit this over a network to execute code without authorization, and this vulnerability is currently being exploited by real attackers.","solution":"Apply mitigations according to Microsoft's vendor instructions while following CISA's BOD 26-04 (Prioritizing Security Updates Based on Risk) guidance. For cloud services, follow BOD 26-04 guidance for cloud environments, or discontinue use of the product if mitigations are unavailable. Organizations must evaluate their systems' internet exposure and ensure they meet BOD 26-04 patching requirements by the due date of 2026-08-24.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69836","publishedAt":"2026-08-21T00:00:00.000Z","cveId":"CVE-2026-69836","cweIds":["CWE-502"],"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["Microsoft"],"affectedVendorsRaw":["Microsoft Entra ID"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"active","epssScore":0.01368,"patchAvailable":true,"disclosureDate":"2026-08-21T00:00:00.000Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality","availability"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.72,"researchCategory":null,"atlasIds":null}}