Microsoft on Thursday announced the rollout of 22 new security updates that resolve severe vulnerabilities across multiple products, including a critical Entra ID zero-day exploited in attacks.
The exploited Entra ID flaw is tracked as CVE-2026-69836, and it could have been exploited for remote code execution (RCE). Microsoft discovered the issue internally and patched it on the server side, with no action required from customers.
The tech giant has not shared any information about the attacks involving exploitation of CVE-2026-69836.
Most of the other patches address critical and high-severity flaws in Microsoft Azure, Entra ID, Exchange, Fabric, and Partner Center products.
The most severe of these include elevation-of-privilege (EoP) bugs in Azure SQL Database (CVE-2026-69502), Azure Arc (CVE-2026-69555 and CVE-2026-65816), and Exchange Online (CVE-2026-65801), as well as an RCE flaw in Azure Managed Instance for Apache Cassandra (CVE-2026-65770), all with a CVSS score of 10/10.
Seven other critical EoP issues were resolved: CVE-2026-68782 (Azure SQL Database), CVE-2026-63509 (Microsoft Fabric), CVE-2026-69851 (Entra ID), CVE-2026-68789 (Azure SQL Database), CVE-2026-69400 (Azure Logic Apps), CVE-2026-62834 (Azure Data Factor), and CVE-2026-66309 (Azure SQL Database).
Additionally, Microsoft patched high-severity vulnerabilities in Azure Virtual Machines, Microsoft Partner Center, Azure Data Factory, Azure Stack HCI, Azure Data Manager for Energy, Copilot in Azure, and Windows Remote Help Defense.
No customer action is required for the majority of these security defects, as Microsoft has deployed the mitigations on the server side.
Earlier this week, Microsoft fixed a high-severity command injection bug in Copilot that could be exploited remotely for information disclosure (CVE-2026-24301).
Last week, the company announced that it was working on patches for ShieldBreak, a zero-day Defender exploit dropped on August 2026 Patch Tuesday by security researcher Nightmare Eclipse (also known as Chaotic Eclipse).
The company assesses that the vulnerability ShieldBreak targets is a high-severity bug, now tracked as CVE-2026-69414 (CVSS score of 7.8).
“Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as ‘ShieldBreak’. We are working to provide a high-quality security update that addresses this vulnerability,” the company said.
* Headline and body of the article have been updated to show that the Entra ID vulnerability has been exploited
Related: CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities
Related: Exploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler
Related: Critical GitLab Flaw Exploited Shortly After Disclosure
Related: CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities
