Entra ID scores a perfect 10.0 RCE, plus twin Azure SQL escalations
CVE-2026-69836 is an unauthenticated deserialization RCE in Microsoft Entra ID (CVSS 10.0). Two Azure SQL Database SQLi bugs (CVE-2026-68789 and CVE-2026-68782, both CVSS 9.9) let low-privilege users take over instances. SPIP has an RCE reported as exploited in the wild.
This is a big one. CVE-2026-69836 is an unauthenticated remote code execution bug in Microsoft Entra ID, CVSS 10.0, no credentials needed, no user interaction. Since Entra ID is the identity backbone for most Microsoft cloud environments, a successful hit here could give an attacker the keys to everything. That's backed up by a pair of Azure SQL privesc bugs and a SPIP RCE that looks actively exploited in the wild. Not a quiet Friday.
Today's CVEs
Sorted by urgencyCVE-2026-69836
NVDAn attacker with no credentials can hit Microsoft Entra ID over the network and run arbitrary code by sending crafted serialized data. CVSS 10.0, no authentication required, no user interaction. Because Entra ID is the identity backbone for most Microsoft cloud environments, a compromise here could hand an attacker the keys to everything.
- Affected estate
- Anyone using Microsoft Entra ID (formerly Azure AD) for identity and access management
- How to check
- Check the Microsoft 365 Service Health dashboard and the Entra admin center for any advisory or required tenant-level action.
- Included because
- unauthenticated; network-exploitable; CVSS 10.0; identity infrastructure
- Action
- Apply any tenant-level mitigations Microsoft publishes. If this is fully server-side, confirm with Microsoft support that your tenant has received the fix.
- Why it matters
- Unauthenticated remote code execution against your identity provider could let an attacker take over accounts, escalate privileges, and pivot across your entire cloud estate.
- Source
- Microsoft Security Response Center
Evidence trail
- NVD: View source
CVE-2026-68789
NVDAn authenticated user on Azure SQL Database can use SQL injection to escalate their privileges over the network. CVSS 9.9. This means a low-privilege database user could potentially gain full control of the database instance. It requires valid credentials, but if you have any shared or service-account access patterns, the blast radius is big.
- Affected estate
- Teams running workloads on Azure SQL Database
- How to check
- Review the Azure Service Health blade and MSRC advisory for affected service versions or regions.
- Included because
- authenticated but low-bar; privilege escalation; CVSS 9.9; widely used cloud database service
- Action
- Apply Microsoft's fix or confirm it has been deployed server-side. Audit and tighten database user privileges as a defense-in-depth step.
- Why it matters
- A low-privilege authenticated user exploiting SQL injection to escalate privileges could read, modify, or destroy data across the entire database.
- Source
- Microsoft Security Response Center
Evidence trail
- NVD: View source
CVE-2026-68782
NVDAnother SQL injection privilege escalation in Azure SQL Database, same pattern as CVE-2026-68789. An authenticated user can escalate privileges over the network. CVSS 9.9. If you're tracking 68789, treat this one the same way: both need to be confirmed fixed on your instances.
- Affected estate
- Teams running workloads on Azure SQL Database
- How to check
- Review the Azure Service Health blade and MSRC advisory. Confirm this CVE is listed as patched for your database instances.
- Included because
- authenticated but low-bar; privilege escalation; CVSS 9.9; widely used cloud database service
- Action
- Confirm the server-side fix is deployed. Audit database user privileges and restrict unnecessary accounts.
- Why it matters
- Same risk as CVE-2026-68789: authenticated SQL injection leading to full privilege escalation on the database.
- Source
- Microsoft Security Response Center
Evidence trail
- NVD: View source
CVE-2026-66788
NVDIf an attacker compromises a spoke cluster in a Submariner/Lighthouse multi-cluster setup, they can manipulate labels or annotations on broker objects to inject EndpointSlices and ServiceImports into any namespace on peer clusters, including kube-system and openshift-* namespaces. CVSS 9.9. This is a privilege escalation path that turns a single compromised spoke into a weapon against your entire multi-cluster mesh. The prerequisite is that the attacker already controls a spoke cluster, so this is a post-compromise escalation rather than an initial entry point.
- Affected estate
- Kubernetes operators running Submariner Lighthouse for multi-cluster service discovery
- How to check
- Run `kubectl get pods -n submariner-operator` or check for Lighthouse components. Review your Submariner/Lighthouse version against the advisory.
- Included because
- privilege escalation; cross-cluster impact; CVSS 9.9; requires prior spoke compromise but high blast radius
- Action
- Upgrade Lighthouse to the fixed version. Audit broker object RBAC and tighten spoke cluster permissions as an interim measure.
- Why it matters
- A compromised spoke cluster can inject malicious resources into critical namespaces on all peer clusters, turning one breach into a fleet-wide compromise.
Evidence trail
- NVD: View source
CVE-2026-77647
NVDUnauthenticated remote code execution in SPIP before version 4.4.20. Attackers can exploit a flaw in how SPIP identifies PHP code blocks and how var_export handles certain characters to run arbitrary code on your server. The description states this was exploited in the wild in August 2026, so treat this as actively targeted even though the structured data doesn't flag it.
- Affected estate
- Anyone running SPIP CMS on versions before 4.4.20
- How to check
- Check the SPIP version in the admin panel or look at the `ecrire/inc_version.php` file for the version string. Versions below 4.4.20 are vulnerable.
- Included because
- unauthenticated; internet-facing; remote code execution; exploited in the wild; CVSS 9.8
- Action
- Update SPIP to 4.4.20 or later. Review server logs for signs of exploitation.
- Why it matters
- Unauthenticated RCE that's already been exploited in the wild. Attackers can fully compromise your web server without any credentials.
Evidence trail
- NVD: View source
One email, every Wednesday morning.
SubscribeFrom the field notes
From this beat
Read the rest of the field notes →