CVE-2026-69836

Assessment

Untrusted-data deserialization in Microsoft Entra ID permits unauthenticated network code execution with CVSS 10.0 impact. The bundle records historical CISA KEV exploitation reporting, but the CVE is absent from the current catalog and a later CERT update says Microsoft clarified that it was not actively exploited; this conflict remains material.

Why it matters

• The stated attack requires no privileges or user interaction and can fully affect confidentiality, integrity, and availability.
• Historical KEV status establishes that exploitation was reported globally at one point, even though it does not establish VTP observation.

Evidence

4 record references and 4 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.

Uncertainties

The reason for KEV withdrawal and the precise relationship between historical reporting and Microsoft's later clarification are not supplied.

Press reports have unknown independence, no exploit is identified, and first-party observation is unknown.

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

Next watchpoint

Further CISA or Microsoft clarification of exploitation status and the KEV withdrawal.