Microsoft has disclosed CVE-2026-109469, a CVSS 10.0 authorization bypass in Entra Device Registration that lets an unauthenticated attacker elevate privileges over a network.
What Is It
CVE-2026-109469 is an authorization bypass through a user-controlled key (CWE-639) in Microsoft Entra Device Registration. Microsoft's description says the flaw "allows an unauthorized attacker to elevate privileges over a network."
Microsoft ([email protected]) published the record to NVD on 2026-11-06. NVD lists its status as "Awaiting Analysis," so NVD has not yet published its own assessment.
Why It Matters
Microsoft scores this flaw 10.0 (CRITICAL) under CVSS 3.1, the highest possible score. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H:
- Network-reachable: the attack works remotely.
- Low complexity: no special conditions are needed.
- No privileges or user interaction required: the attacker needs no account and no victim action.
- Scope changed: a successful attack can affect resources beyond the vulnerable component.
- High impact on confidentiality, integrity and availability.
The exploitability subscore is 3.9 and the impact subscore is 6.0.
Exploitation status: this CVE is not currently in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied sources do not confirm active exploitation.
What's Vulnerable
- Vendor: Microsoft
- Product: Entra Device Registration
- Versions: listed as affected with no specific version (
-)
Microsoft tagged the CVE exclusively-hosted-service. That means the flaw is in a service Microsoft hosts and runs, not in software that customers install. NVD lists no affected CPEs.
Patch Status
The supplied NVD data does not describe a patch, a fix date or any action customers need to take. The exclusively-hosted-service tag suggests Microsoft handles the fix on its own side, but the record doesn't say whether that has happened. CISA has not set a required action or due date because the CVE is not in KEV.
Organizations that use Entra ID should read the Microsoft Security Response Center (MSRC) advisory for the official remediation status and any guidance for customers.