Microsoft Reverses Its Own ‘Exploitation’ Warning on Entra ID Flaw CVE-2026-69836

Microsoft disclosed a maximum-severity remote code execution vulnerability in Entra ID (CVE-2026-69836, CVSS 10.0) caused by unsafe deserialization, then reversed its advisory's "Exploited: Yes" designation to "No" without explanation a day later, leaving enterprises uncertain whether active attacks occurred. The company server-side patched the flaw affecting its cloud identity platform that underpins Microsoft 365, Azure, and thousands of federated applications, but declined to disclose detection methods, scope of exposure, or evidence supporting either exploitation claim. The reversal raises questions about transparency in vulnerability reporting, particularly for cloud services where only the provider holds forensic facts needed to assess materiality under emerging SEC and CISA disclosure frameworks.