On August 20, Microsoft disclosed a maximum-severity remote code execution flaw in Entra ID — the identity service behind Microsoft 365 logins. It was fixed in the cloud, and no customer action was required. That "no action required" is the most useful part of this story.

What happened

On Thursday, August 20, Microsoft's security team disclosed CVE-2026-69836 — found by the company's own principal security engineer, Robert Fitzpatrick — a remote code execution vulnerability in Entra ID, the cloud service that handles authentication for Microsoft 365: your email, your documents, your Teams sign-ins. It scored a perfect 10.0 out of 10, the highest severity rating that exists: an unauthenticated attacker could theoretically reach it over the network with no user interaction.

The technical cause was unsafe deserialization — a class of bug where an application converts untrusted input into active code structures without validating it first. It's a well-known weakness pattern, and it's exactly the kind of flaw you don't want in the system that guards every login in your company.

Then came the twist worth paying attention to. The original bulletin flagged the flaw as exploited in the wild — and that's how most news outlets still describe it. On Friday, following an inquiry from The Hacker News, Microsoft corrected the status: there was no evidence of exploitation after all. The change was reported by Cybersecurity Dive and Forkast, though most other outlets never picked it up. Microsoft hasn't said why the label flipped — which is a fair thing to flag: when the vendor running your identity infrastructure is also the only source of truth about whether it was attacked, you're trusting the fix without being able to verify the timeline yourself. That's a real limitation of cloud-native disclosure, even if it doesn't change what you need to do today.

Because either way, the outcome for customers was the same:

Microsoft had already fixed it on their side. No action was required from anyone using Microsoft 365.

Why this matters to you even if you've never heard of Entra ID

If your business runs on Microsoft 365 — and most do — then every workday starts by touching Entra ID. It's the front door to your email, your files, and often your accounting software's single sign-on. A perfect-10 flaw in that door sounds like it should be your emergency.

It wasn't — because of where the responsibility line sits.

Your business technology stack is split into two categories:

  • Managed services (Microsoft 365, Shopify core, Stripe, Google Workspace): the vendor runs the servers, watches for attacks, and ships fixes. When something breaks, they fix it while you sleep.
  • Self-managed systems (your WordPress site, its plugins, your Magento store, your own server): nobody patches these but you. When a security release lands, updating is your job.

The Entra ID story is the managed side working as designed. Just over a week earlier, WordPress 7.0.4 and Magento APSB26-92 were the self-managed side doing the same job — except there, the update only protects you after you install it.

The catch: "no action required" doesn't mean nothing to do

Microsoft's cloud handled the code. But three things around any managed service are still yours:

  1. Admin accounts. Your Microsoft 365 admin account is the crown jewel. If it uses a password without multi-factor authentication, no vendor patch will save you from credential theft. Turn on MFA today if you haven't.
  2. Fake patch emails. Headline-grabbing disclosures like this one reliably spawn phishing: "URGENT: install this emergency Entra ID security patch." Microsoft said explicitly that no customer action is required — so any email or download offering an "emergency patch" is a scam by definition. Delete it.
  3. Know which side of the line each tool sits on. Make a simple list: what does your vendor patch automatically, and what do you have to update yourself? Most small businesses can't answer that question — and the self-managed column is exactly where breaches start.

The takeaway

A CVSS 10.0 flaw in the world's biggest identity platform was disclosed and neutralized inside two days, and the correct response for millions of businesses was: nothing. That's what managed infrastructure buys you.

But the same week, shop owners were installing WordPress and Magento updates themselves — because those systems sit on their side of the line. Security isn't about reacting to every headline. It's about knowing which headlines require you to act, and having a routine so those actions take minutes, not weekends.

If you're not sure which parts of your stack are your responsibility, that uncertainty itself is the risk worth fixing first.

Related readings: