sentinel-aidefense/cve-2026-69836-expCVE-2026-69836 — Unauthenticated RCE via Entra ID deserialization
CVE-2026-69836 is a critical unauthenticated remote code execution vulnerability in Microsoft Entra ID due to improper deserialization of untrusted data (CWE-502). The flaw allows attackers to execute arbitrary code over the network with no authentication, user interaction, or special privileges required. This PoC demonstrates an exploit that achieves full RCE in patched environments, enabling complete compromise of identity data, token theft, privilege escalation, and lateral movement across Microsoft 365, Azure, and connected SaaS applications.
Microsoft Entra ID versions affected by CVE-2026-69836: all pre-patch releases (pre-August 2026 patches). Confirmed in Microsoft Security Response Center advisory.
The vulnerability stems from unsafe deserialization of untrusted data in the Entra ID authentication and token-handling pipeline, allowing object injection and gadget chain execution to arbitrary code execution.
Example:
python3 cve-2026-69836.py login.microsoftonline.com --cmd "whoami && whoami > /tmp/pwned.txt"
The exploit triggers the deserialization flaw, executes the supplied command, and returns output or establishes a persistent shell.
DISCLAIMER: For authorized penetration testing and red teaming only. Do not use against systems you do not own.