Microsoft's Identity Backbone Just Had a Perfect-10 RCE Exploited in the Wild, and Five Federal Agencies Say AI Is Now Writing the Exploits Hitting Your Water Plant

Start with the number that should stop you mid-scroll: 10.0. Microsoft confirmed active exploitation of CVE-2026-69836, a maximum-severity remote code execution flaw in Entra ID — the cloud identity platform formerly known as Azure Active Directory that authenticates logins and enforces access policy across Microsoft 365, Azure, and effectively every third-party application that trusts Microsoft's identity layer. The bug is a deserialization-of-untrusted-data flaw (CWE-502): Entra ID's backend was processing specially crafted serialized data objects without properly validating them first, letting an attacker with zero privileges and zero user interaction execute arbitrary code over the network. Microsoft says exploitation happened before public disclosure, that the flaw has already been fully mitigated on its end, and that customers don't need to patch anything themselves — this is a cloud-service-side fix, not a downloadable update. That's genuinely good news operationally. It is not a reason to do nothing: Microsoft's own advisory recommends reviewing Entra ID sign-in logs, conditional access policies, and privileged role assignments for anomalous activity, because "already mitigated" tells you the hole is closed, not that nobody walked through it first. Identity infrastructure at this scale is exactly the kind of target where a quiet look-back matters more than the patch status.

This didn't happen in isolation. On the same day, Microsoft closed out four additional maximum-severity flaws: CVE-2026-65816 and CVE-2026-69555 let unauthenticated attackers escalate privileges on Azure Arc, CVE-2026-65801 did the same on Exchange Online, and CVE-2026-65770 enabled remote code execution on Azure Managed Instances for Apache Cassandra. None of the five were assigned by coincidence to the same week — cloud identity and cloud infrastructure vulnerabilities of this severity landing together is a reminder that the attack surface worth obsessing over in 2026 increasingly isn't the server in your own rack, it's the identity and orchestration layer sitting above every service you don't directly control. It's also worth noting this isn't Entra ID's first brush with a global-scope flaw: security researcher Dirk-jan Mollema disclosed a critical Entra ID privilege escalation bug last September that could have granted an attacker complete access to any organization's tenant worldwide. Identity platforms this central don't get a pass just because the last incident is old news.

The second story of the day matters less for its technical novelty and more for what it confirms about where AI-assisted attacks are actually landing right now: not in some abstract future scenario, but in the water plant down the road. Five federal agencies — the NSA, CISA, the FBI, the Department of Energy, and the EPA — issued a joint advisory this week warning of an active, ongoing campaign against Siemens S7 Series programmable logic controllers, the industrial computers that open valves, run pumps, and control machinery across water treatment, energy, manufacturing, chemical, food and agriculture, and defense-industrial-base facilities. The agencies did not hedge: "this is not a theoretical risk — it is an active threat." Attackers are combining internet-wide scanning platforms like Censys and ZoomEye with open-source industrial automation libraries — specifically snap7.dll and python-snap7 — and AI-assisted scripting to build custom tools that mimic legitimate OT monitoring software closely enough to blend in. Suspected ties to Iranian operators are being reported, echoing an April warning about Iranian-linked actors targeting exposed Rockwell Automation and Allen-Bradley PLCs that caused real disruption and financial loss.

The mechanism matters as much as the attribution. AI isn't inventing a new vulnerability class here — the underlying weakness is exactly what it's always been: poorly secured, internet-exposed PLCs that were never designed to be reachable from the open internet in the first place. What AI is doing is collapsing the time and expertise an attacker needs to go from "found an exposed PLC" to "have a working, disguised exploitation tool," and that compression is the actual news. Siemens itself said Thursday it hadn't detected an increased attack volume or any previously unknown vulnerabilities in its products — a fair, narrow, and true statement that doesn't really contradict the advisory, since the flaws being exploited aren't new bugs in Siemens' code, they're old, familiar exposure problems getting hit faster and more convincingly. The agencies' recommended detection signals are worth keeping on hand regardless of whether you run Siemens gear specifically: connections to PLCs from non-engineering workstations, unusual data-block access or write operations outside scheduled maintenance windows, sequential IP scanning on port 102 (the S7comm protocol port), repeated connection attempts, and any use of snap7.dll outside your own approved systems. If you operate PLCs of any brand, the baseline action is the same one CISA gave in April and is giving again now: inventory every PLC, confirm none are internet-facing, apply available patches, and segment OT networks from anything routable from outside. This is precisely the kind of advisory our OT & ICS section exists to surface as it happens, not weeks later in a quarterly roundup.

On the vulnerability-disclosure front, Cisco patched a cluster of flaws in its Crosswork network automation suite that reads like a checklist of what you don't want to see in one product family. CVE-2026-20030, an SQL injection flaw, and CVE-2026-20357, a missing-authentication-for-critical-function flaw, both scored a perfect CVSS 10.0. CVE-2026-20358, an external control of file system paths flaw, also hit 10.0. CVE-2026-20359, an insufficiently protected credentials flaw, came in at 9.9. All four affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning regardless of device configuration, impacting Cisco Crosswork release 7.2.1 and earlier; a fix is available in 7.2.1-SP. Cisco separately shipped fixes for five additional vulnerabilities in Cisco Secure Workload. Crosswork sits at the automation and orchestration layer for large carrier and enterprise networks — exactly the kind of platform where a missing-authentication bug isn't a footnote, it's a direct line to reconfiguring how traffic moves across a network. If Crosswork is anywhere in your environment, 7.2.1-SP isn't optional homework for next sprint.

On the breach side, Toronto's Hospital for Sick Children — SickKids — confirmed it was attacked again, with employee data stolen this time, a genuinely uncomfortable repeat given the hospital was targeted by ransomware once before. Healthcare providers don't get to "graduate" out of being targets after surviving one incident; if anything, a successful prior breach tends to mean an organization's environment and staff are already mapped by whoever came through the door the first time, or by others watching the same public reporting everyone else read. Separately, U.S. prosecutors charged 17 Iranian hackers over the theft of 31 terabytes of academic data — a reminder that a meaningful share of this year's most consequential intrusions aren't ransomware crews chasing a payout, they're state-linked operations chasing research and intellectual property at a scale that dwarfs most ransomware hauls, just without the extortion note that makes ransomware easy to notice.

Four stories, one shape repeating underneath all of them: identity infrastructure, industrial control systems, network orchestration platforms, and healthcare data all got hit this week not because attackers found something exotic, but because the load-bearing layer — the thing everything else trusts — turned out to be the softest point once someone looked closely enough. Entra ID's flaw lived in how it trusted incoming serialized data. The Siemens campaign lives on PLCs that were never supposed to trust the open internet in the first place. Cisco's Crosswork bugs lived in missing authentication on functions that should have required it. None of this needed a novel technique. It needed defenders to keep asking, layer by layer, what's actually being trusted that shouldn't be — and attackers, increasingly with AI doing the grunt work, to keep finding the layer nobody re-checked this year.