Quick links
Press Enter to search, Esc to close
Vulnerability
An authorization bypass through a user-controlled key in Microsoft Entra Device Registration, a cloud service with no customer-installed version.
In short
CVE-2026-109469 is an authorization bypass through a user-controlled key in Microsoft Entra Device Registration, a cloud service with no customer-installed version. Microsoft's own record says it lets an unauthorized attacker elevate privileges over a network. Microsoft, the CNA, scores it CVSS 3.1 10.0 Critical. Its Security Update Guide says the flaw is already fixed, with no action required from customers.
CVE-2026-109469 is an authorization bypass through a user-controlled key in Microsoft Entra Device Registration. Microsoft's own record describes it in one line: an unauthorized attacker can use the flaw to elevate privileges over a network. Entra Device Registration is the cloud service a device calls to become Microsoft Entra registered, Microsoft Entra joined, or Microsoft Entra hybrid joined.
The CVE record and NVD both score CVE-2026-109469 CVSS 3.1 10.0 Critical, the top of the scale. The vector marks the flaw as reachable over the network, needing no privileges and no user action. Impact is high on confidentiality, integrity and availability.
Microsoft assigned CWE-639 to the flaw. MITRE's own definition of CWE-639 describes a pattern where a system's authorization check fails to stop one user from reaching another user's data. The user changes a key value that the user already controls. Microsoft's record does not name the specific key or operation involved beyond its one-line description.
Microsoft's own documentation says a device identity from Entra registration, Entra join, or Entra hybrid join is a prerequisite for device-based Conditional Access policies. The same device identity is required for Intune device management. Organizations that gate access on a managed or compliant device are the ones this kind of flaw could reach. Our Key Eater coverage looks at a separate Entra ID credential risk in the same identity layer.
Microsoft's Security Update Guide lists CVE-2026-109469 as not exploited and not publicly disclosed before the fix. It rates future exploitation of the flaw Less Likely. As of CISA's Known Exploited Vulnerabilities catalog version 2026.11.06, the CVE is not listed there.
Microsoft's record and NVD name Entra Device Registration itself as the affected product, with no version range. It is a Microsoft-hosted cloud service, not software a customer installs or updates.
Microsoft's Security Update Guide carries a standing answer for this class of entry: "This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take." It adds that the CVE exists "to provide further transparency."
The CVE record also carries Microsoft's exclusively-hosted-service tag. Microsoft's own transparency post says that tag marks a cloud-service CVE where the fix happened on Microsoft's side. No customer action is required.
Microsoft's Security Update Guide lists its release date for CVE-2026-109469, rating future exploitation Less Likely.
The CVE record and NVD publish the entry, both carrying Microsoft's exclusively-hosted-service tag.
Microsoft's Security Update Guide says it already fixed CVE-2026-109469 on its own infrastructure and lists no customer action. Treat an exclusively-hosted-service entry as informational, not as a deployment task.
We recommend checking Microsoft Entra device registration and sign-in logs for devices your organization cannot account for, since Microsoft's record does not state when the underlying flaw began.
Microsoft's own documentation ties device registration to device-based Conditional Access and Intune management. We recommend confirming those policies require a managed, compliant device rather than registration alone.
Microsoft's transparency post says it will keep publishing CVEs for critical cloud flaws even without customer action. We recommend watching the Security Update Guide for this tag on services your organization depends on.
Microsoft's record names Microsoft Entra Device Registration itself, a cloud service with no customer-installed version, tagged exclusively-hosted-service.
No. Microsoft's Security Update Guide says it already fixed the flaw on its own infrastructure and lists no action for customers.
Microsoft's Security Update Guide lists it as not exploited and not publicly disclosed before the fix, and rates future exploitation Less Likely.
It is not listed in catalog version 2026.11.06.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
