Microsoft mitigates CVSS 10 Entra device registration flaw

Microsoft has disclosed CVE-2026-109469, a critical elevation of privilege flaw in Entra Device Registration, the service that registers and joins devices to Microsoft Entra ID. The vulnerability is scored CVSS 10.0 and is described as an authorization bypass through a user-controlled key, enabling an unauthenticated attacker to elevate privileges over the network. The weakness maps to CWE-639. Microsoft has not specified which identifier or endpoint was involved, nor the exact privileges that could be gained.

The advisory states the issue has already been fully mitigated in the service, with no customer action required and no indicators of compromise published.

There is no evidence of exploitation at the time of reporting. As of 10 November 2026, Microsoft lists CVE-2026-109469 as not exploited and not publicly disclosed, with an exploitability assessment of “Exploitation Less Likely.” Microsoft emphasises that the flaw was mitigated within the service itself, so no unpatched customer version exists for attackers to target.

The article notes that the historical risk relates to the mechanism by which device identities enable device-based Conditional Access, and that MITRE ATT&CK tracks related techniques such as Account Manipulation: Device Registration (T1098.005). While no direct link to a specific threat actor is established, the piece highlights the importance of monitoring device registration activity and reviewing related permissions and limits as a precautionary hygiene measure.

For Entra admins, no patch or configuration change is required. The piece suggests tenant-side checks: audit device activity on Entra Devices, verify who is authorised to join or register devices and the maximum device limit, consider enforcing MFA for the registration action, remove stale or unknown devices, and watch for bursts of device registrations. These steps are presented as general hunting ideas, not Microsoft guidance for this CVE.