CVE-2026-109469: CVSS 10 Entra Device Registration Flaw

What happened?

Microsoft has disclosed CVE-2026-109469, a critical elevation of privilege vulnerability in Entra Device Registration, the cloud service that registers and joins devices to Microsoft Entra ID. The flaw carries a maximum CVSS score, meaning that an unauthenticated attacker could exploit it over the network with no user interaction. Customers have nothing to patch. Microsoft says it has fully mitigated the issue in the service, lists it as neither exploited nor publicly disclosed, and rates exploitation as less likely.

Key details

• Microsoft disclosed CVE-2026-109469, a critical elevation of privilege flaw in Entra Device Registration with a maximum CVSS 10.0 score.
• The vulnerability is an authorization bypass via a user-controlled key allowing unauthenticated network attackers to elevate privileges.
• Device registration in Entra ID underpins device-based Conditional Access and has been abused by threat actors via legitimate features.

Summarised by SecOraLens from SOCRadar. Always read the original source before acting. How SecOraLens verifies advisories.