Two maximum-severity flaws surfaced this week in the infrastructure that decides who and what gets access, and they were fixed on completely different clocks. One closed itself before most defenders even learned it existed. The other is sitting open on appliances until an administrator patches it.
A 10.0 That Needed No Patch, and a 9.3 That Does
On August 20, Microsoft published an advisory for CVE-2026-69836, a maximum-severity remote code execution flaw in Microsoft Entra ID, the cloud identity service formerly known as Azure Active Directory. The bug carries a CVSS base score of 10.0 and stems from deserialization of untrusted data, letting an unauthorized attacker execute code over the network. According to Microsoft’s own advisory record, the flaw is not publicly disclosed in technical detail and Microsoft’s assessment lists exploitation as “less likely,” with no confirmed exploitation recorded against the CVE.
What makes the advisory unusual is what it does not ask customers to do. Microsoft’s Security Response Center writes in the advisory’s FAQ: “This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.” The fix shipped inside the service itself, before the CVE number existed, under a Microsoft cloud-CVE transparency initiative that discloses server-side fixes after the fact rather than asking tenants to patch anything.
Media Partner
A day earlier, Citrix (now under Cloud Software Group) published a security bulletin, CTX696939, for two flaws in NetScaler ADC and NetScaler Gateway. The more severe, CVE-2026-19490, is a CVSS 9.3 authentication bypass that lets an unauthenticated attacker skip login checks on appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server; on older firmware the Gateway or AAA configuration alone meets the precondition, without SAML needing to be configured at all. The companion flaw, CVE-2026-19489, is an 8.8 memory-overflow issue tied to SIP ALG on LSN group configurations. Citrix’s bulletin states plainly: “Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible.” There is no workaround. Fixed builds are 14.1-73.32 and 13.1-63.21 and later, including the FIPS lines. Security firm Rapid7 said that as of August 19 it had seen no evidence of active exploitation.
This publication has covered this pattern before: Citrix has repeatedly landed on CISA’s Known Exploited Vulnerabilities catalog within days of a bulletin going public, which is why security teams treat a fresh NetScaler advisory as a live countdown rather than routine patch-cycle reading, regardless of whether exploitation has been confirmed yet.
The gap between the two advisories is not just about where the software runs. It is about who is responsible for closing the gap. Microsoft’s fix required zero customer action because Microsoft owns the runtime end to end. Citrix’s fix requires action from every one of its customers, on every affected appliance, on their own schedule, which is precisely the interval attackers try to compress.
Same Layer, Two Disclosure Models
Both bugs sit in the identity and access layer: one is the cloud directory that issues tokens for Microsoft 365 and countless connected apps, the other is the on-premises gateway that brokers remote access and single sign-on into corporate networks. Both hit the ceiling of the CVSS scale or close to it. And yet the operational reality for a defender reading both advisories in the same week could not be more different.
Entra ID is a service Microsoft operates. When a deserialization flaw that size turns up, Microsoft patches its own infrastructure and only then tells the world, because there is no tenant-side configuration to change. The CVE exists for the record, not for the to-do list. NetScaler is software an organization runs on its own appliances. When Citrix finds a bypass that size, the fix is a build number a customer has to install, and until that install happens, the exposure is live on every internet-facing Gateway or AAA server that meets the precondition.
That split is not a one-off. It is becoming the default shape of identity-infrastructure disclosure: severity score tells you how bad a flaw is, not who has to act on it or how fast.
What It Means for the Security Leader
A CISO who triages purely by CVSS number will treat a 10.0 and a 9.3 as roughly the same emergency. They are not. The Entra ID advisory requires reviewing conditional access and sign-in logs for the disclosure window as good hygiene, but nothing to deploy. The NetScaler advisory requires an immediate build check and, on any internet-facing Gateway or AAA virtual server, an emergency patch cycle regardless of whether SAML is configured. Confusing the two wastes the scarce hours that matter most on the appliance that is still exposed.
The practical fix is an inventory question, not a scoring question: which parts of the identity stack are vendor-operated cloud services, and which are software this organization runs and must patch itself? Score alone cannot answer it, a point this publication has made before about severity numbers that do not tell defenders what to patch first. Cloud-service CVEs at 10.0 with a “no action required” FAQ should be logged and reviewed, not treated as a fire drill; the useful follow-up is a spot check of sign-in and conditional-access logs for the disclosure window, not a change ticket. Self-managed identity infrastructure at 9.0-plus, with a build number and no workaround, should go to the top of the patch queue the same day the bulletin lands, before proof-of-concept exploitation narrows the runway further: confirm the NetScaler build against 14.1-73.32 or 13.1-63.21, confirm whether the appliance is configured as a Gateway or AAA virtual server, and patch those first regardless of whether SAML is in the mix.
As identity itself keeps expanding to cover machine and agent identities, not just human logins, the number of components a security team has to sort into “vendor’s problem” versus “our problem” only grows. Building that map now, before the next matching pair of advisories lands in the same week, is cheaper than doing it under pressure.
