Microsoft has fully mitigated a maximum-severity remote code execution flaw in Entra ID, the cloud identity service formerly known as Azure Active Directory that gates access to Microsoft 365 and thousands of connected third-party applications. Tracked as CVE-2026-69836 with a CVSS score of 10.0, the bug stems from deserialization of untrusted data and was found by Microsoft Principal Security Engineer Robert Fitzpatrick.
The Microsoft Security Response Center says the vulnerability is already fully mitigated and that no customer action is required, describing the advisory as a transparency disclosure. The bulletin originally said the flaw was under active exploitation, then was updated on Friday to state there was no exploitation, according to Cybersecurity Dive. Microsoft has not explained the change or detailed who may have targeted the service.
For hospitals and health systems, the significance is that Entra ID sits at the center of identity infrastructure: it verifies logins for email, EHR portals, and third-party clinical applications, and its compromise would give attackers a direct path into the applications clinicians use every day. Healthcare organizations that run hybrid setups or have conditional access policies tied to Entra ID should verify that Microsoft’s mitigation has reached their tenant, even though no patch deployment is required.
Because no remediation steps are needed, the main task for security teams is awareness and documentation. Confirm that tenant-level security defaults remain enforced, review sign-in logs for anomalies over the past month, and make sure the incident is logged in any vendor risk register.
This is the second max-severity identity flaw to surface in Microsoft products this year, underscoring how much of healthcare access management now rests on a single cloud identity provider.
