Entra ID: A Perfect 10, and Nothing to Patch: What the

A central cloud identity hub authenticating a dental practice's workstations, laptop, phone, and apps

August 22, 2026 A Perfect 10, and Nothing to Patch: What the Exploited Entra ID Flaw (CVE-2026-69836) Really Asks of Your Dental Practice

Posted at 05:38h in IT Security by Raymond

Every morning your front desk signs into the practice-management software, staff open Microsoft 365 email, and the hygienists log into the workstations. Almost every one of those logins, if your office runs on Microsoft’s cloud, is verified by a single service you have probably never thought about by name: Entra ID. On 21 August 2026, Microsoft disclosed that this service had a flaw rated a perfect 10 out of 10 — the worst score the scale allows — and that attackers had already been exploiting it. Then it told administrators there was nothing to do. Both halves of that sentence are true, and together they carry a lesson worth more than the scare.

What Entra ID is, and why a flaw in it rates a ten

Entra ID — the service Microsoft formerly called Azure Active Directory — is the cloud identity layer that verifies logins and controls access to Microsoft 365, Azure, and the growing list of third-party apps that authenticate through a Microsoft account. It is not one application among many; it is the door every other application opens onto. When a member of your team proves who they are and is granted access, Entra ID is what made that decision.

That central role is exactly why a vulnerability inside it is so serious. A flaw in a single practice workstation compromises a workstation. A flaw in the identity service that authenticates everyone is a flaw in the front door to the entire building. The Common Vulnerability Scoring System tops out at 10.0, reserved for the rare bugs that are both trivially reachable and catastrophic in impact, and CVE-2026-69836 earned every point of it.

A severity gauge pinned at maximum beside a server crack already sealed with light — A CVSS 10.0 is as bad as the scale goes. This one was already exploited — and already sealed on Microsoft’s side.

What actually happened with CVE-2026-69836

In Microsoft’s own words, the advisory describes “deserialization of untrusted data in Microsoft Entra ID” that “allows an unauthorized attacker to execute code over a network.” Translated out of the jargon: an attacker who had not logged in at all — no stolen password, no account — could send specially crafted data to the service and have it run their code inside Microsoft’s cloud identity infrastructure. That is the unauthenticated remote-code-execution scenario security teams fear most, and it is why the score sits at the ceiling.

The flaw was found by one of Microsoft’s own principal security engineers, and the company acknowledged it had been exploited in the wild before public disclosure. Microsoft has not said who was behind the attacks, when they began, how many organizations were touched, or what the attackers did once inside — the kind of silence that, understandably, does little to settle nerves. What it has said is more reassuring, and it is the part that matters for your practice.

Why “no customer action required” is genuinely true this time

Microsoft’s advisory is unusually direct: “This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.” Because Entra ID is a cloud service that Microsoft operates on its own infrastructure, the fix lived entirely on Microsoft’s side. There is no update to download, no server in your closet to patch, no version number to check. The company repaired the code, and the repair reached every tenant at once, including yours.

This is a real and welcome difference from the vulnerabilities we usually write about. When a flaw lands in software you run — as with the actively exploited Windows IKE flaw that demanded urgent patching — the clock starts ticking for you the moment it is public. Here, the clock was Microsoft’s, and it has already run out. A cloud flaw fixed centrally is genuinely one you can exhale about. But the reason you can exhale is worth understanding, because it also defines exactly where your own responsibility begins.

A shield split into a provider platform zone above and a customer configuration zone below — Shared responsibility in one picture: Microsoft owns the platform’s code; your practice still owns how the tenant is configured and watched.

The part that is still your job: shared responsibility

Moving to the cloud does not outsource your security; it divides it. Under the shared-responsibility model, Microsoft owns the identity platform — its code, its infrastructure, its patching — and it clearly held up that end here by finding and fixing a critical bug before most customers ever heard of it. But the practice still owns everything about how its own tenant is configured and monitored: who has accounts, how strongly they authenticate, what they are allowed to reach, and whether anyone is watching the logins.

That distinction is the whole lesson of CVE-2026-69836. The platform-level flaw was never something you could have fixed or prevented — and it wasn’t your job to. The identity attacks that are your job are the ones aimed at your tenant directly: a phished password, a stolen session cookie that walks an attacker past MFA, a forged login exploiting a misconfiguration. Microsoft cannot fix those for you, because they are not flaws in its code — they are gaps in how your identity is set up and watched.

An identity-hardening checklist with toggles for passkeys, conditional access, least privilege, and log review — The controls Microsoft cannot set for you: strong MFA or passkeys, conditional access, least privilege, and someone actually reading the sign-in logs.

What a dental practice should actually do about identity

The right response to a fixed cloud flaw is not to do nothing; it is to spend the attention you did not have to burn on emergency patching on the identity controls that are permanently yours to own:

Enforce strong, phishing-resistant authentication. Make multi-factor authentication mandatory for every account, and move toward passkeys where you can. Passkeys resist the phishing and session-theft tricks that ordinary MFA does not, and they are the direction Microsoft itself is pushing identity.

Tighten conditional access. Entra ID can restrict logins by location, device health, and risk level — blocking or challenging a sign-in from an unexpected country or an unmanaged device before it ever reaches your data. For a practice whose staff all log in from the same building, sensible conditional-access rules quietly shut a great many doors.

Apply least privilege. Not every user needs administrator rights, and a compromised account can only do as much damage as its permissions allow. Give each account the access its role requires and no more, and keep the powerful admin roles to a deliberate few.

Actually read the sign-in logs. Entra ID records every authentication, flags risky ones, and will show you an impossible-travel login or a burst of failed attempts — but only if someone looks. The controls insurers and regulators now expect are the same ones we walked through in what a cyber policy makes you attest to, and identity monitoring sits near the top of that list.

None of this is exotic, and none of it depends on Microsoft. It is the portion of cloud security that stays with the practice no matter how flawlessly the provider runs its platform — and it is also what both HIPAA and Ontario’s PHIPA expect of anyone safeguarding patient information: reasonable, current controls over who can reach protected health data.

A practice manager and IT professional reviewing a sign-in activity dashboard with one anomaly highlighted — Microsoft fixed its flaw automatically. Spotting an attack aimed at your tenant specifically is still a job someone has to do.

The bottom line for your practice

CVE-2026-69836 is a rare piece of good news wearing an alarming number. A maximum-severity flaw in the service your practice logs in through was exploited, found, and fixed — and the fix arrived without you lifting a finger. Take the reassurance it offers, and take the lesson too: the cloud carried the platform’s weight this time, but the identity attacks aimed squarely at your tenant are still yours to defend against, and always will be.

If you would like a clear picture of how your practice’s Microsoft 365 identity is actually configured — whether MFA and passkeys are truly enforced, whether conditional access and least privilege are set sensibly, and whether anyone is watching the sign-in logs that would reveal an attack aimed at you — contact Compudent Systems. We help dental practices across Ontario own their half of cloud security with confidence, so that when the provider does its job, your side is just as ready.

Sources & further reading:

A Perfect 10, and Nothing to Patch: What the Exploited Entra ID Flaw (CVE-2026-69836) Really Asks of Your Dental Practice