Microsoft Ships 22 Security Updates, Patching Entra ID Zero-Day CVE-2026-69836
Updated
Updated · SecurityWeek · Aug 21
Microsoft Ships 22 Security Updates, Patching Entra ID Zero-Day CVE-2026-69836
3 articles · Updated · SecurityWeek · Aug 21
Summary
Microsoft rolled out 22 security updates, including a server-side fix for Entra ID flaw CVE-2026-69836, a critical remote-code-execution bug the company said had been exploited in attacks.
CVE-2026-69836 was discovered internally, and Microsoft said customers do not need to take action because the mitigation was deployed on the service side.
Five other flaws carried CVSS 10/10 ratings, including elevation-of-privilege bugs in Azure SQL Database, Azure Arc and Exchange Online, plus an RCE issue in Azure Managed Instance for Apache Cassandra.
Most remaining fixes covered critical or high-severity weaknesses across Azure, Entra ID, Fabric, Partner Center and other cloud products, again largely patched server-side.
The release follows a Copilot command-injection fix earlier this week and comes as Microsoft is still preparing an update for the ShieldBreak Defender vulnerability, now tracked as CVE-2026-69414.