Microsoft Entra ID Unauthenticated Remote Code Execution via Deserialization of Untrusted Data

#Requires -Modules Microsoft.Graph.Reports, Microsoft.Graph.Authentication
<#
.SYNOPSIS
    CVE-2026-69836 exposure-window audit for Microsoft Entra ID.
.DESCRIPTION
    Queries Entra ID sign-in logs for anomalous activity during the
    plausible exposure window (2026-07-01 to 2026-08-20) before
    Microsoft's server-side remediation.
    Outputs: VULNERABLE (anomalies found) / PATCHED (no anomalies) / UNKNOWN (unable to query).
.PARAMETER TenantId
    Your Azure AD / Entra ID tenant ID (GUID).
#>
param(
    [Parameter(Mandatory)]
    [string]$TenantId
)

$ErrorActionPreference = 'Stop'
$exposureStart = '2026-07-01T00:00:00Z'
$exposureEnd   = '2026-08-20T23:59:59Z'
$anomalyThreshold = 5

try {
    Write-Host '[*] Connecting to Microsoft Graph...' -ForegroundColor Cyan
    Connect-MgGraph -TenantId $TenantId -Scopes 'AuditLog.Read.All','Directory.Read.All' -NoWelcome
} catch {
    Write-Host "UNKNOWN - Failed to connect to Microsoft Graph: $_" -ForegroundColor Yellow
    exit 2
}

try {
    Write-Host "[*] Querying sign-in logs for exposure window ($exposureStart to $exposureEnd)..." -ForegroundColor Cyan

    # Check for anomalous service principal sign-ins
    $filter = "createdDateTime ge $exposureStart and createdDateTime le $exposureEnd and signInEventTypes/any(t: t eq 'servicePrincipal')"
    $spSignIns = Get-MgAuditLogSignIn -Filter $filter -Top 100 -ErrorAction SilentlyContinue

    # Check for sign-ins with unusual risk levels
    $riskFilter = "createdDateTime ge $exposureStart and createdDateTime le $exposureEnd and riskLevelDuringSignIn eq 'high'"
    $riskySignIns = Get-MgAuditLogSignIn -Filter $riskFilter -Top 100 -ErrorAction SilentlyContinue

    # Check for unusual directory role assignments during the window
    $auditFilter = "activityDateTime ge $exposureStart and activityDateTime le $exposureEnd and category eq 'RoleManagement'"
    $roleChanges = Get-MgAuditLogDirectoryAudit -Filter $auditFilter -Top 100 -ErrorAction SilentlyContinue

    $anomalyCount = 0
    $findings = @()

    if ($riskySignIns -and $riskySignIns.Count -gt $anomalyThreshold) {
        $anomalyCount += $riskySignIns.Count
        $findings += "High-risk sign-ins during exposure window: $($riskySignIns.Count)"
    }

    if ($roleChanges -and $roleChanges.Count -gt 0) {
        $anomalyCount += $roleChanges.Count
        $findings += "Privileged role changes during exposure window: $($roleChanges.Count)"
    }

    Write-Host ''
    Write-Host '=== CVE-2026-69836 Exposure Window Audit ===' -ForegroundColor White
    Write-Host "Tenant:          $TenantId"
    Write-Host "Window:          $exposureStart to $exposureEnd"
    Write-Host "Risky sign-ins:  $($riskySignIns.Count)"
    Write-Host "Role changes:    $($roleChanges.Count)"
    Write-Host ''

    if ($anomalyCount -gt 0) {
        Write-Host 'VULNERABLE - Anomalous activity detected during exposure window. Investigate further.' -ForegroundColor Red
        foreach ($f in $findings) { Write-Host "  [!] $f" -ForegroundColor Red }
        Write-Host ''
        Write-Host 'Recommended: Engage your IR team to review these events in detail.' -ForegroundColor Yellow
        Disconnect-MgGraph | Out-Null
        exit 1
    } else {
        Write-Host 'PATCHED - No anomalous activity detected during the exposure window.' -ForegroundColor Green
        Write-Host 'Microsoft remediated this vulnerability server-side before disclosure.' -ForegroundColor Green
        Write-Host 'No customer-side patching action is required.' -ForegroundColor Green
        Disconnect-MgGraph | Out-Null
        exit 0
    }
} catch {
    Write-Host "UNKNOWN - Failed to query audit logs: $_" -ForegroundColor Yellow
    Write-Host 'Ensure your account has AuditLog.Read.All and Directory.Read.All permissions.' -ForegroundColor Yellow
    try { Disconnect-MgGraph | Out-Null } catch {}
    exit 2
}