Microsoft fixed nine perfect-10 flaws in its cloud this month and told you about none of them, which is the good news

On Friday August 21, a story went round that Microsoft’s cloud identity service had a maximum-severity vulnerability which attackers were already exploiting. The CVE was CVE-2026-69836, an unsafe deserialization flaw in Microsoft Entra ID, the service formerly called Azure Active Directory that holds the login for every Microsoft 365 tenant. It scored CVSS 10.0, the top of the scale. Microsoft’s advisory had the Exploited field set to Yes.

A day later that field said No. Microsoft’s own revision note, version 1.1 dated August 21, reads:

Corrected Exploited to No. This vulnerability was not exploited in the wild. This is an informational change only.

Nobody did anything wrong here, exactly. Microsoft published, outlets reported what the advisory said, Microsoft corrected it, and most outlets updated. But the whole episode is a useful window into a category of security news that small businesses are now inside whether they know it or not, and it buried a much more interesting set of numbers.

The numbers nobody reported

We pulled Microsoft’s August 2026 security release directly from its Security Update Guide API and filtered for one thing: advisories carrying Microsoft’s standard cloud-service language, “This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take.”

There are 39 of them. Every single one is rated Critical. Nine scored a perfect 10.0:

Seven more scored 9.9, including a second Entra ID flaw (CVE-2026-69851) and the Entra Provisioning Service (CVE-2026-59115). Azure SQL Database appears six times across the 39. Microsoft Teams appears three times.

Read the top row again. Exchange Online, the mail service behind essentially every small business on Microsoft 365, had a server-side request forgery flaw that let an unauthenticated attacker over a network elevate privileges, scored at the absolute maximum of the CVSS scale. It got no headlines because there was nothing for anyone to do about it, and the “Exploited” checkbox said no.

The Entra ID one got headlines because for about 24 hours a checkbox said yes.

Why you never heard about the other 38, and why that is deliberate

Until mid-2024, none of this would have been published at all. Cloud providers, all of them, historically did not disclose vulnerabilities found and fixed in their own services unless the customer had to do something. If Microsoft found and fixed a hole in Exchange Online over a weekend, you would never know it existed.

On June 27, 2024, Microsoft changed that policy. It committed to issuing CVEs for critical cloud service vulnerabilities “regardless of whether customers need to install a patch or to take other actions to protect themselves.” To keep the extra noise manageable it added a customerActionRequired field to the Security Update Guide and its API, and it tags the CVE.org record with exclusively-hosted-service.

That is a genuinely good change, and we want to be clear about it before criticising anything. Thirty-nine critical cloud vulnerabilities that were previously invisible are now a matter of public record. Amazon and Google have not, to our knowledge, matched it at anything like this level of detail.

But it produces an odd situation for anyone reading security news. A category of CVE now exists that is simultaneously the most severe kind, in the most business-critical services, and completely un-actionable. There is no patch. There is no configuration change. There is no way to check whether your tenant was affected, when it was fixed, or whether anything happened to your data first. Microsoft’s advisory says the purpose of the CVE “is to provide further transparency,” and that is the whole of it.

What the Entra ID one actually was, precisely

For the record, from Microsoft’s advisory and the NVD entry, both retrieved this morning:

• Published: August 20, 2026. Revised to version 1.1 on August 21.
• Description: “Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.” Weakness class CWE-502.
• CVSS 3.1 base score: 10.0, vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Network attack vector, low complexity, no privileges required, no user interaction, and a changed scope, meaning the impact reaches beyond the vulnerable component.
• Temporal score: 8.7, with E:U for unproven exploit code, RL:O for an official fix, RC:C for confirmed.
• Exploited: No, as corrected on August 21.
• Discovered by: Robert Fitzpatrick, a Microsoft principal security engineer. It was found internally.
• Customer action required: none. Microsoft told The Hacker News: “We identified and addressed this issue with a fix and released CVE-2026-69836 for greater transparency. There are no additional actions customers need to take.”
• CISA’s own assessment, recorded in the NVD entry on August 21 under its SSVC framework: exploitation none, automatable yes, technical impact total.

The temporal vector is worth a note, because it was consistent with the correction before the correction happened. E:U means unproven exploit code exists. An advisory claiming active exploitation while its own vector string says the exploit is unproven is internally inconsistent, and that inconsistency was published for a day.

The honest read for a business owner

Three things, and we will try to keep the sales instinct out of them.

First, this is not a reason to leave Microsoft 365. A vulnerability found internally by Microsoft’s own security engineer, fixed centrally before disclosure, with no exploitation, is close to the ideal outcome of a security programme. Compare it to the alternative most small businesses ran a decade ago: an Exchange server in a cupboard, patched when someone remembered. We have written about what happens to on-premises SharePoint and Exchange when a critical flaw lands and the patch has to be applied by hand. Central patching is a real, large improvement, and the nine 10.0s in this month’s list are evidence of it working rather than evidence of it failing.

Second, the trade you made is visibility. You gave up the ability to patch and, with it, the ability to know. When SharePoint on-premises had its emergency in July, the question “was I compromised” had an answer: check the server, check the logs, check the files. For Entra ID, that question has no answer available to you. You cannot know whether your tenant was in the affected population, when the fix reached it, or whether anything was accessed in the interval. Microsoft is not going to tell you, and the CVE record does not contain it. That is a real cost, and it is the cost you accepted along with the benefit. It is worth being conscious of rather than surprised by.

Third, none of this is your actual risk. This is the part that matters most and gets the least attention. A pre-authentication remote code execution flaw in Entra ID, patched by the vendor with no exploitation, is not what compromises a Toronto accounting firm or a Mississauga clinic. What compromises them is the ordinary stuff: a stolen session token, a staff member approving an MFA prompt they did not initiate, an OAuth consent grant to a malicious app, an account with no MFA at all, a departed employee whose access nobody revoked.

Added August 30, 2026. The first item on that list now has numbers attached to it. ANY.RUN’s August 18 analysis of the Mirage2FA phishing service counted 4,561 session cookie thefts against Microsoft 365 accounts, and the stolen cookie is the reason a password reset does not end the incident. We wrote up how the relay works, which Entra controls stop it, and which ones only appear to, in the piece on adversary-in-the-middle session theft.

The four things you can actually control

Since the CVE list gives you nothing to do, here is a list that does. All four are free, all four live in the Entra admin centre, and all four defend against the attacks that actually happen to businesses your size.

1. Turn on the security defaults, or build conditional access policies. Microsoft’s security defaults require every user to register for MFA, require administrators to use it on every sign-in, prompt other users for it when the risk signals warrant, block legacy authentication protocols, block device code flow, and protect privileged activities. Legacy auth is the important one: protocols like POP, IMAP and SMTP AUTH cannot present an MFA challenge, so an attacker with a valid password walks straight past any MFA policy you have. Microsoft’s own figure is that MFA plus blocking legacy authentication stops more than 99.9% of common identity-based attacks, and both are free on the Entra ID free tier. If your tenant was created before October 22, 2019, security defaults were not switched on for you, and legacy auth may still be enabled with nobody having noticed. Check under Entra ID, then Overview, then Properties, then Manage security defaults. One warning from Microsoft’s own documentation: confirm no administrator is still relying on an older protocol before you enable it, or you will lock something out.

2. Count your global administrators. Microsoft’s documented best practice is fewer than five, and the Entra overview page will show you an alert card once you hit five or more. Separately, Microsoft recommends keeping two cloud-only emergency access accounts permanently assigned the Global Administrator role, not tied to any individual, with at least one excluded from all conditional access policies, and with long random credentials kept somewhere physical rather than in the password manager that could itself be compromised. Every global admin beyond what you need is a full-tenant compromise waiting on one phishing email. Check under Roles and administrators, then Global Administrator.

3. Review app consent. Under Enterprise applications, look at what third-party applications have been granted permissions to your tenant and what those permissions are. Anything with Mail.Read, Files.Read.All or Directory.Read.All that you cannot account for should go. Then restrict who can consent to new applications at all: user consent for unverified publishers is one of the most reliable routes into a Microsoft 365 tenant, and turning it off costs you nothing except an occasional approval request.

4. Look at the sign-in logs for what should be impossible. Entra keeps sign-in logs, and you have access to them even though you have no access to Microsoft’s own incident data. Filter for successful sign-ins from countries you do not operate in, and for legacy authentication clients. The catch is retention: on Entra ID Free it is seven days, for both sign-in and audit logs, rising to 30 days only with a P1 or P2 licence. And it is not retroactive, so buying a licence after an incident does not recover the logs that already aged out. Seven days is short enough that “we will check the logs if something happens” usually means “the logs will be gone.” Either look at them on a schedule, or export them somewhere.

If you would like a second pair of eyes on any of that, send us a note. Reviewing a small tenant’s admin roles, consent grants and legacy auth settings takes about an hour and does not require access to anything sensitive.

One prediction

Expect this category of CVE to grow, quickly. Thirty-nine critical cloud vulnerabilities in one month is not a spike; it is what disclosure looks like once a provider commits to it, and the number was presumably similar in the years before anyone published it. As Amazon and Google come under pressure to match Microsoft’s policy, the volume of security news you can do nothing about is going to increase a lot.

The useful discipline, and we think this will matter more each year, is to sort security news into two piles on sight. Pile one: things where an action exists, meaning apply an update, change a setting, rotate a credential. Pile two: things where the vendor already handled it and the CVE is a receipt. Pile two is worth exactly one minute of your attention, which is enough to confirm it is in pile two. A CVSS 10.0 in pile two deserves less of your day than a CVSS 6.0 in pile one, and almost all security coverage is written to make you feel the opposite.

Sources

• CVE-2026-69836, Microsoft Security Update Guide, published August 20, 2026, revised August 21, 2026. Advisory text, CVSS vectors, revision history and the 39-CVE count were retrieved from Microsoft’s Security Update Guide API on August 23, 2026.
• CVE-2026-69836, National Vulnerability Database, including the CISA SSVC assessment dated August 21, 2026 and the exclusively-hosted-service tag
• Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution, The Hacker News, August 21, 2026, which obtained Microsoft’s statement and prompted the correction
• Microsoft sounds alarm as perfect-10 Entra ID flaw comes under attack, The Register, August 21, 2026, published against the pre-correction advisory
• Toward greater transparency: Unveiling Cloud Service CVEs, Microsoft Security Response Center, June 27, 2024
• Security defaults in Microsoft Entra ID, Best practices for Microsoft Entra roles and Microsoft Entra data retention, Microsoft Learn