Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-109469 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-07 |
| Vendor | Microsoft |
| Product | Entra Device Registration |
| CVSS Score | 10.0 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Authorization bypass through a user-controlled key (CWE-639) in Microsoft Entra Device Registration allows an unauthorized attacker to elevate privileges over a network. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) means a remote attack with no authentication and no user interaction, with impact reaching beyond the vulnerable component.
According to MSRC (published November 5, 2026), the vulnerability was not publicly disclosed before publication and has not been exploited, and exploitation is assessed as “Exploitation Less Likely”. This is a cloud service vulnerability — Microsoft publishes such CVEs for transparency after fixing the issue in its own infrastructure.
Required Actions
No customer action is required. Microsoft states in MSRC that the vulnerability has been fully mitigated on the service side, and users do not need to install updates or change configuration.
As a reasonable follow-up check, consider:
- reviewing the device list in the Microsoft Entra admin center (Devices → All devices) for unknown or recently registered devices, especially those marked as compliant or Entra joined;
- checking the Entra audit logs for events in the Device category (device registration, addition and updates) over recent weeks;
- confirming that device settings restrict who can register and join devices, and that Conditional Access policies relying on device state work as intended.
Who Is Affected?
The vulnerability affects the Entra Device Registration service by Microsoft — the Microsoft Entra ID (formerly Azure AD) component responsible for registering and joining devices. Virtually every organization using Microsoft 365 with devices registered or joined to Entra ID (including hybrid and Intune-managed setups) relies on it. Because Microsoft has deployed the fix, organizations do not need to update anything.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
