Microsoft Entra Device Registration elevation of privilege CVE-2026-109469 (CVSS 10.0) — already mitigated in the cloud service
Microsoft Entra Device Registration (hosted cloud service)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
CVE-2026-109469 is an authorization bypass through a user-controlled key in Microsoft Entra Device Registration that Microsoft rates Critical with CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It lets an unauthorized attacker elevate privileges over a network against the Entra Device Registration service. Microsoft says the vulnerability has already been fully mitigated in the hosted service, customers need no action, and the CVE is published for transparency under Microsoft's cloud-service CVE program. Not known to be exploited or publicly disclosed before publication; Exploitation Less Likely per MSRC.
Why this severity: MS Critical / CVSS 10.0 network EoP with no auth or user interaction and changed scope; cloud service already mitigated; Exploitation Less Likely; not known exploited at publication
- Started
- Nov 5, 2026
Affected
- Microsoft Entra Device Registration before Microsoft's cloud-side mitigation (fixed in service; no customer update)
Fixed in
- Entra Device Registration as mitigated by Microsoft (no customer action required; CVE for transparency)
Timeline2
NVD lists CVE-2026-109469 as awaiting analysis with Microsoft's Critical 10.0 vector and exclusively-hosted-service tag.
Microsoft publishes CVE-2026-109469 for an Entra Device Registration elevation of privilege (Critical, CVSS 10.0); FAQ says the cloud service is already fully mitigated and customers need no action.
Advisories3
News & write-ups1
Notes & caveats
Hosted Entra Device Registration only. Microsoft FAQ: already fully mitigated; no customer update or config change. Cite MSRC/NVD/CVE — never cve.now.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
