Entra ID
Security incidents tagged Entra ID. Newest first.
1 Entra ID incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 2
- Longest quiet run: 1 day (Nov 7–Nov 7)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- Patched
Microsoft Entra Device Registration elevation of privilege CVE-2026-109469 (CVSS 10.0) — already mitigated in the cloud service
CVE-2026-109469 is an authorization bypass through a user-controlled key in Microsoft Entra Device Registration that Microsoft rates Critical with CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It lets an unauthorized attacker elevate privileges over a network against the Entra Device Registration service. Microsoft says the vulnerability has already been fully mitigated in the hosted service, customers need no action, and the CVE is published for transparency under Microsoft's cloud-service CVE program. Not known to be exploited or publicly disclosed before publication; Exploitation Less Likely per MSRC.
Microsoft Entra Device Registration (hosted cloud service)Since Nov 5, 2026
