Entra ID - DIESEC

ConnectWise Supply Chain Attack Hits Microsoft 365

By Editorial Team | October 26, 2026

ConnectWise supply chain attack: Storm-0940 abuses stolen cloud app credentials against Microsoft 365 tenants, October 2026

The ConnectWise supply chain attack now has a name behind it. Microsoft assesses that the China state-aligned group Storm-0940 used stolen credentials of ConnectWise cloud applications to sign in to customer Microsoft 365 tenants, with AI agents doing the work. Disabling the ConnectWise connection may not be enough, because the attackers could have added credentials…

Microsoft Entra ID RCE Vulnerability Exploited

By Editorial Team | August 24, 2026

A maximum-severity Microsoft Entra ID RCE vulnerability was already being exploited before Microsoft's August 20 disclosure, and no customer patch exists.

Microsoft disclosed a maximum-severity Microsoft Entra ID RCE vulnerability on August 20, 2026, and confirmed the flaw was already being exploited in the wild before the advisory went public. CVE-2026-69836 carries a CVSS score of 10.0, needs no authentication and no user interaction, and sits in the identity backbone underneath Microsoft 365, Azure AD sign-in,…