On Wednesday, Microsoft disclosed CVE-2026-69836, an unauthenticated remote code execution flaw in Entra ID with a CVSS score of 10.0. Exploited in the wild. Microsoft's principal security engineer found it, Microsoft fixed their own infrastructure before saying a word publicly, and then they published the CVE anyway under their cloud transparency program.
There is no patch for you to apply. No KB article. No configuration change. The guidance is that no customer action is required.
That's a maximum severity vulnerability in the identity system most of the enterprise world runs on, confirmed as actively exploited, with no attribution, no timeline, no scope, no post-exploitation detail, and not a single indicator of compromise. And the official ending is that you should do nothing.
I've been on the other side of enough of these disclosures to know what happens next, and it's one of two things. Panic: it's a ten, there's no information, somebody tell me what to do. Or complacency, which is worse because it looks like discipline. I was told to do nothing, so I'll do nothing, and I'll go back to the sprint.
Both are wrong for the same reason. A ten and "do nothing" are in direct conflict, and that conflict is the most useful thing Microsoft gave you this week.
The number was never the point
I've argued before that CVSS is an input rather than an answer. A 9.8 with no path to anything you care about matters less than a 7.6 that chains into your ERP. This piece doesn't walk that back.
There is no higher number than ten. That shouldn't mean panic, and it shouldn't mean running off to take random action. It should mean give it your attention. Then ask the only question that pays: what do I already have in place that would blunt this, and can I prove it?
Here's what makes this worth your Friday. If you can answer that for a ten you know nothing about, you can answer it for a nine, a 7.6, and a 4.3. The exercise doesn't scale down from severity, it scales out from your environment. The ten is just what made you look.
The goal of cybersecurity was never to certify that we're safe. It's to certify we've done all the reasonable things within our control and our budget to reduce risk to the business. Those are different jobs, and only one of them is achievable.
Swiss cheese, and why it's still the only model that works
Any single slice of Swiss cheese has solid parts and parts with holes. You build a security program by stacking slices so the holes in one layer sit over solid material in the next. Do that well enough and the stack behaves like a solid block, even though no layer of it is solid on its own.
That's the whole discipline. Every control you own is porous. You are never buying the absence of holes, you're buying misalignment.
Microsoft just confirmed a hole in a slice you don't own, can't inspect, and can't patch. That's uncomfortable. It's also not the thing that will hurt you. What will hurt you is if the slices underneath have holes in the same place, and nobody has looked in three years.
The door changed, the hallway didn't
Verizon's 2026 DBIR made a finding that got less attention than it deserved. Exploited vulnerabilities are now the leading initial access vector at 31%, up from 18% the prior year, knocking credential theft off the top spot for the first time in the report's 19 year history. Most coverage stopped there.
Keep reading. Credential abuse fell to 13% as an initial vector, but across the full breach progression it still appears in 39% of breaches. Attackers changed how they get in. They didn't change what they do once they're inside.
An Entra RCE is the 31% story. Everything after it is the 39% story, and that part sits entirely inside your control. You can't patch this door. You can absolutely shrink the hallway behind it.
Start with the things that are free
The best compensating controls don't require another tool or another line item. They're things you already configure to operate the business, and they can be configured well or badly at the same cost.
Identity is the largest of these, and where we've been sloppiest, because we've always overprovisioned access and we almost never go back to look.
We tell ourselves we audit. What we actually do is hygiene. We look for accounts unused for thirty or ninety or a hundred eighty days. Maybe we suspend accounts during family leave. Those are fine, and they miss the real problem, because the real problem is an active user.
Take somebody who's been with you nine years across sales, customer service, delivery, finance, and production. They're carrying five distinct sets of permissions, granted at five different times for five jobs, four of which they no longer do. Which are still valid? Which do they still need? Which do they even touch? Nobody asks, because nothing forces the question, and the account looks healthy on every report you run.
We're also not correlating what people were granted against what they actually use. Granted and used are different questions, and the second one is where the exposure lives.
Then there are non-human identities, and I want to be precise about why they're a problem. They're a problem because we overprovisioned them, not because machines have identities. We didn't know what development would need, we got tired of running an access review every time they needed one more permission, so we handed over admin. Then admin somewhere else. Then full read and write over there. Tight read-only scopes, continuous monitoring, and secrets kept out of source control would have bought us years. We didn't do any of it, and it didn't feel like a mistake until attackers started taking over service accounts.
The pattern holds outside identity. BreachLock's 2026 penetration testing report, built on 4,970 tests and 531,770 findings, saw testers repeatedly escalate privilege through parameter manipulation and walk straight past approval workflows. Insecure design and business logic flaws doubled year over year, from 8% to 16% of findings. Those aren't scanner findings. They're consequences of how things were configured and who was allowed to do what. (Disclosure: BreachLock is a client of Phronia Counsel.)
What to say when your CEO asks
A vendor disclosed a serious flaw in a service we depend on, they fixed it before telling anyone, and we have no way to confirm whether it touched us. We're using it as a scheduled review of the controls that would have limited the damage, and we'll have an answer on where we stand by a specific date.
That's honest, it doesn't require you to know something you can't know, and it demonstrates the only thing a board can reasonably ask of you.
The asks
To CISOs and security leaders. Five moves, all free, none requiring procurement. Certify least privilege so that it also means least harm, meaning your team can demonstrate it today rather than point at a policy. Audit role accumulation across job changes. Correlate real access patterns against granted permissions. Tighten non-human identity scope and get secrets out of code. And sequence all of it by blast radius, auditing the systems holding PII and IP first, because that's what turns a five item list into something you'll actually finish.
To Microsoft and the cloud providers. Publishing this CVE was the right call, and I'd rather have it than not. "No customer action required" is still never an acceptable ending, because it produces paralysis in one half of your customers and complacency in the other. If there is genuinely nothing to patch, publish what's left that has value: scope, timeline, indicators, and the lesson a defender should take so they're better positioned the next time. A CVE that teaches a defender nothing isn't transparency. It's a receipt.
To boards. Your job is making sure the executive team is doing its duty to protect the company. So how are you auditing security well enough to know whether they are? And if the most senior security role in your organization is a director-level position, you already have your answer, and it isn't the one you want.
---