On 21 August 2026, Microsoft published CVE-2026-69836: an untrusted data deserialisation flaw in Microsoft Entra ID, rated CVSS 10.0, the maximum score. It allowed an unauthenticated attacker to execute code remotely on the service that governs access to Microsoft 365, Azure and all third-party applications connected via SSO. Two details change how the event should be read. First, Microsoft applied the mitigation on the server side before publication: according to the vendor, no action is required from customers. Second, the vulnerability was not exploited in the wild. The researcher who led to its correction, Robert Fitzpatrick, a principal security engineer at Microsoft, reported it internally. On paper, the incident is closed.
This apparent closure is precisely the problem. A CVSS 10.0 on the identity provider that centralises your access deserves a formal lessons-learned review, even without exploitation. Without that step, your risk register ignores an event that, had it occurred a month earlier, could have been the starting point of a mass compromise scenario. Your NIS2 and DORA obligations require you to keep a record of it: Microsoft's transparent mitigation does not exempt you from doing so.
The blast radius of a compromised IdP
An identity provider is not an ordinary application. It decides access for your entire digital ecosystem: email, document storage, ERP, CRM, development tools, third-party SaaS platforms via SAML or OIDC. Remote code execution on Entra ID would allow an attacker to issue valid tokens for any identity, without leaving a usable trace in your usual SIEM. Detection on the client side is then close to impossible: access logs reflect authentications that are technically legitimate.
In 2024, an earlier compromise of this kind, the so-called Midnight Blizzard incident, allowed a Russian state-linked group to access the mailboxes of several Microsoft senior executives. CISA then issued Emergency Directive 24-02 in April 2024, requiring all US federal agencies to reset their Entra ID tokens and audit their OAuth applications. The case sets a precedent: a CVSS 10.0 on an IdP is never an ordinary vulnerability, and the risk persists after mitigation, through tokens issued during the window of vulnerability.
What identity concentration already costs
The 2025 figures from France's national cybersecurity agency (ANSSI), published in its cyber threat overview of 11 March 2026, are revealing. 196 data exfiltration incidents were handled, an increase of 51% compared with 2024. The threat actors attributed to Russian and Chinese groups remain the most active against French interests. Identity compromises, such as token theft, MFA bypass and service account abuse, are over-represented in this statistic. ANSSI also recorded 128 ransomware compromises over the same period, the majority of which entered through an authentication weakness.
The French data protection authority (CNIL) now explicitly sanctions identity-related failings. On 13 January 2026, Free and Free Mobile were fined EUR 15 million and EUR 27 million, a combined EUR 42 million, for security failings including the absence of multi-factor authentication on critical interfaces. On 22 January 2026, France Travail was fined a further EUR 5 million following a cyberattack that exploited authentication weaknesses. These amounts illustrate a regulatory shift: the identity link is no longer a technical detail, it is a priority point of inspection.
A concrete example: the lessons-learned review that is missing
Take a French mid-sized industrial company (ETI) with 800 employees, subject to NIS2 as an important entity. Its information system relies on Microsoft 365, Azure and around twenty SaaS applications connected via SSO to Entra ID. On 21 August, CVE-2026-69836 is published. No alert comes up in its SIEM. No ticket is opened. The security team, which filters CVEs by the presence of a known exploit, sets the file aside on the grounds that the mitigation is already in place.
Three months later, the mock audit preparing for an ANSSI inspection asks: which events with no operational impact affecting your authentication chain were the subject of a documented lessons-learned review in 2026? No record exists for CVE-2026-69836. The auditor notes this absence as a traceability gap under Article 21 of the NIS2 Directive, which requires continuous risk management, not only a reaction to confirmed incidents. The remediation takes half a day, but the observation remains in the audit file.
Four reflexes to embed before the next CVE
Map the identity surface. Your main IdP, yes, but also the outbound SAML federations, the OAuth applications that have been granted consent (often forgotten), the service accounts linked to provisioning, and the non-human identities synchronised via SyncFabric or equivalent. Without this inventory, an IdP incident cannot be contained. The article on non-human identities in NIS2 and DORA programmes sets out the method.
Set up administrator access outside the IdP. The break-glass account is a basic requirement of an identity continuity plan: two local accounts, stored outside Entra ID, with passwords sealed in a physically accessible safe, tested once a quarter. Without this path, an outage or a compromise of your IdP leaves you with no means of recovery.
Write the "IdP unavailable" scenario into the continuity plan. Most continuity plans cover the loss of a site, a hosting provider or an ERP. Few cover the failure of an identity provider. Defining recovery time objectives for authentication, failover scripts, and internal communication during an incident: these elements are missing from most of the NIS2 plans audited.
Review your ICT third-party clauses. Article 28 of DORA requires that your contracts with critical ICT third-party providers set out incident notification arrangements, audit rights and resilience testing. An identity provider is one of them, even if your procurement function has not historically treated it as such. Add a clause requiring rapid notification of critical CVEs, and require the vendor to publish its patch application timelines.
What this episode says about your governance
CVE-2026-69836 is a maximum-severity event that left no visible trace in your environment. That is precisely what makes it a trap for your processes. Teams that record only incidents with an operational impact will miss this kind of signal. NIS2 auditors will not: the ability to identify, trace and handle events without impact is part of Article 21.
Good practice is to open a record in your risk management register as soon as a critical CVE affecting a component of your identity chain is published, to document the decision not to act where that decision is justified, and to schedule a simulation exercise within thirty days. Twenty minutes of analysis is worth more than an undocumented zero impact. At the next CVSS 10.0, the auditor's first question will be "where is your impact analysis?", before the question of the patch.