# Microsoft Entra Device Registration elevation of privilege CVE-2026-109469 (CVSS 10.0) — already mitigated in the cloud service · pwn.watch

> CVE-2026-109469 is an authorization bypass through a user-controlled key in Microsoft Entra Device Registration that Microsoft rates Critical with CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It lets an unauthorized attacker elevate privileges over a network against the Entra Device Registration service. Microsoft says the vulnerability has already been fully mitigated in the hosted service, customers need no action, and the CVE is published for transparency under Microsoft's cloud-service CVE program. Not known to be exploited or publicly disclosed before publication; Exploitation Less Likely per MSRC.

Page: https://pwn.watch/i/microsoft-entra-device-registration-eop-cve-2026-109469 · generated 2026-11-07T00:16:17.842Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Microsoft Entra Device Registration (hosted cloud service)
- Started: 2026-11-05
- CVEs: CVE-2026-109469
- Affected: Microsoft Entra Device Registration before Microsoft's cloud-side mitigation (fixed in service; no customer update)
- Fixed in: Entra Device Registration as mitigated by Microsoft (no customer action required; CVE for transparency)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/microsoft-entra-device-registration-eop-cve-2026-109469/feed.xml
- JSON Feed: https://pwn.watch/i/microsoft-entra-device-registration-eop-cve-2026-109469/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/microsoft-entra-device-registration-eop-cve-2026-109469.json
- This file: https://pwn.watch/i/microsoft-entra-device-registration-eop-cve-2026-109469/llms.txt

## Updates (newest first)
- 2026-11-06: NVD lists CVE-2026-109469 as awaiting analysis with Microsoft's Critical 10.0 vector and exclusively-hosted-service tag. (https://nvd.nist.gov/vuln/detail/CVE-2026-109469)
- 2026-11-05: Microsoft publishes CVE-2026-109469 for an Entra Device Registration elevation of privilege (Critical, CVSS 10.0); FAQ says the cloud service is already fully mitigated and customers need no action. (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109469)

## Fix brief
# Security brief: Microsoft Entra Device Registration elevation of privilege CVE-2026-109469 (CVSS 10.0) — already mitigated in the cloud service

Source: https://pwn.watch/i/microsoft-entra-device-registration-eop-cve-2026-109469 · status: live · severity: critical · updated Nov 6, 2026, 23:25 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
CVE-2026-109469 is an authorization bypass through a user-controlled key in Microsoft Entra Device Registration that Microsoft rates Critical with CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It lets an unauthorized attacker elevate privileges over a network against the Entra Device Registration service. Microsoft says the vulnerability has already been fully mitigated in the hosted service, customers need no action, and the CVE is published for transparency under Microsoft's cloud-service CVE program. Not known to be exploited or publicly disclosed before publication; Exploitation Less Likely per MSRC.

Severity detail: MS Critical / CVSS 10.0 network EoP with no auth or user interaction and changed scope; cloud service already mitigated; Exploitation Less Likely; not known exploited at publication

- Product: Microsoft Entra Device Registration (hosted cloud service)
- CVE / advisory ids: CVE-2026-109469

## Affected versions
- Microsoft Entra Device Registration before Microsoft's cloud-side mitigation (fixed in service; no customer update)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Entra Device Registration as mitigated by Microsoft (no customer action required; CVE for transparency)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
Cloud-service CVE (exclusively-hosted-service). customerActionRequired=false. Keep patchStatus patched. Do not invent on-prem fix versions.

## Latest updates
- Nov 6, 2026: NVD lists CVE-2026-109469 as awaiting analysis with Microsoft's Critical 10.0 vector and exclusively-hosted-service tag.
- Nov 5, 2026: Microsoft publishes CVE-2026-109469 for an Entra Device Registration elevation of privilege (Critical, CVSS 10.0); FAQ says the cloud service is already fully mitigated and customers need no action.

## Advisories
- [CVE-2026-109469 — Entra Device Registration Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109469) (MSRC)
- [CVE-2026-109469](https://nvd.nist.gov/vuln/detail/CVE-2026-109469) (NVD)
- [CVE-2026-109469](https://www.cve.org/CVERecord?id=CVE-2026-109469) (CVE)

## Write-ups & news
- [Toward greater transparency: Unveiling Cloud Service CVEs](https://aka.ms/MSRC-Cloud-CVEs)

## Caveats
Hosted Entra Device Registration only. Microsoft FAQ: already fully mitigated; no customer update or config change. Cite MSRC/NVD/CVE — never cve.now.

---
Machine-readable: https://pwn.watch/i/microsoft-entra-device-registration-eop-cve-2026-109469.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.