Advisory · CVE-2026-109469
Microsoft Entra Device Registration authorization bypass allows unauthenticated privilege escalation
Microsoft Entra Device Registration lets an unauthorized attacker elevate privileges over the network through an authorization bypass using a user-controlled key, rated critical at CVSS 10.0 with changed scope and no privileges or user interaction required.
- Vendor
- Microsoft
- Product
- Entra Device Registration
- Identifier / CWE
- CVE-2026-109469
CWE-639 - Action timing
- Immediate
Explain it like I’m five
Entra asks a device to prove itself with a key, but it trusts a key the visitor supplies. An attacker can hand over a doctored key and be treated as a privileged device, with no login at all.
- 01Attacker-controlled key
An unauthorized attacker crafts a device registration request carrying a user-controlled key.
- 02Authorization check bypassed
Entra Device Registration fails to validate the key against the registering identity.
- 03Privilege elevated
The attacker gains elevated privileges over the network, with the scope of the compromise extending beyond the registration service.
- 04No interaction needed
No privileges and no user interaction are required, so the flaw is reachable by any network attacker.
What happened
Microsoft disclosed CVE-2026-109469 on November 6, 2026: an authorization bypass through a user-controlled key in Entra Device Registration. An unauthorized attacker can elevate privileges over a network. The record rates it critical at CVSS 10.0 under version 3.1, with network attack vector, low complexity, no privileges required, no user interaction, and changed scope.
No affected version range is published in the NVD record, and the Microsoft Security Update Guide page did not render for this run, so no fix or mitigation version is claimed here. The 10.0 score reflects the worst case: unauthenticated, network-reachable privilege escalation in an identity service that gates device trust. Treat it as an identity-plane issue, not a single-host bug.
What to do
- Follow Microsoft’s Security Update Guide entry for CVE-2026-109469 and apply the update or mitigation it lists.
- Audit Entra device registrations for devices that gained privileged roles or unexpected trust, and review registration events around the disclosure.
- Restrict who and what can register devices, and treat device registration as a privileged operation until the guidance is applied.
- Review sign-in and audit logs for anomalous device registrations and privilege grants.
- Revoke or re-register any device whose registration cannot be accounted for, and rotate credentials tied to affected identities.
- Confirm the tenant state after applying Microsoft’s guidance.
Management note
A 10.0 in an identity service is a trust-boundary failure, not a patch queue item. The device that proves itself to Entra is the device your conditional access decisions trust, so audit registrations before assuming the blast radius is small.