CVE-2026-109469: CVSS 10 Entra Device Registration Flaw

Microsoft has disclosed CVE-2026-109469, a critical elevation of privilege vulnerability in Entra Device Registration, the cloud service that registers and joins devices to Microsoft Entra ID. The flaw carries a maximum CVSS score, meaning that an unauthenticated attacker could exploit it over the network with no user interaction.

Customers have nothing to patch. Microsoft says it has fully mitigated the issue in the service, lists it as neither exploited nor publicly disclosed, and rates exploitation as less likely. The CVE exists for transparency, and Microsoft has released almost no technical detail beyond the score and the weakness type.

What Is CVE-2026-109469?

Microsoft’s advisory describes CVE-2026-109469 (CVSS 10.0) as an authorization bypass through a user-controlled key in Entra Device Registration that allows an unauthorized attacker to elevate privileges over a network. The weakness maps to CWE-639. In plain terms, that class covers services that accept an identifier supplied by the requester, such as an object or record ID, without checking that the requester is allowed to act on that object.

Microsoft has not said which identifier was involved, which endpoint accepted it or what privileges an attacker could have gained. It has not named a discoverer, and its only FAQ entry explains why there is no update: the vulnerability “has already been fully mitigated by Microsoft,” and users of the service have no action to take.

Is CVE-2026-109469 Being Exploited?

No exploitation has been reported. As of November 10, 2026, Microsoft lists CVE-2026-109469 as not exploited and not publicly disclosed, and its exploitability assessment is “Exploitation Less Likely.” The temporal score also marks exploit code maturity as unproven, and SOCRadar found no public proof of concept (PoC) or technical write-up for the flaw.

Microsoft says the issue has been fully mitigated in the service, so there is no unpatched customer version for attackers to target. What the advisory does not cover is the period before the fix: Microsoft has not said how long the flaw existed or whether it checked for earlier abuse, so the “not exploited” status reflects what Microsoft disclosed at release.

Why Entra Device Registration Matters

Device identity carries weight in Entra ID. Microsoft documents three ways a device gets one:

• Entra registration for personal and mobile devices,
• Entra join for organization-owned Windows devices,
• and hybrid join for devices also tied to on-premises Active Directory.

Device identities are a prerequisite for device-based Conditional Access, so a device’s registration state can decide whether a sign-in satisfies a policy.

Attackers have abused that trust through legitimate features. MITRE ATT&CK tracks the behavior as T1098.005 (Account Manipulation: Device Registration), in which adversaries register a device to an account they control to get around MFA or Conditional Access. Microsoft’s research on Storm-2372 described the actor registering its own device in Entra ID after device code phishing and obtaining a Primary Refresh Token (PRT) to reach organizational resources. Microsoft now assesses Storm-2372 as an initial access sub-cluster of Midnight Blizzard.

Nothing links Storm-2372 or any other actor to CVE-2026-109469. The comparison shows why a flaw in the registration service itself deserves attention, even after Microsoft has closed it.

What Should Entra Admins Do?

No patch or configuration change is required. Microsoft has not said when the flaw was introduced or mitigated, and it has published no indicators of compromise. For teams that want tenant-side assurance, a review of device registration activity is reasonable hygiene. The steps below are general hunting ideas, not Microsoft guidance for this CVE:

• Audit device activity: Review the audit logs on the Entra Devices page for unexpected device creations, owner changes or registrations from unfamiliar locations and client user agents
• Check registration rights: Confirm who is covered by “Users may join devices to Microsoft Entra ID” and “Users may register their devices with Microsoft Entra ID,” and review the “Maximum number of devices” limit
• Require MFA for registration: Microsoft recommends the “Register or join devices” user action in Conditional Access for enforcing MFA, with the separate MFA device setting left at “No” when that policy is in place
• Clean up device objects: Remove stale or unrecognized devices, especially any that satisfy device-based Conditional Access conditions
• Watch for registration bursts: Flag a single user registering several devices in a short period, a pattern that public detection rules already cover

A clean review does not prove the flaw was never used. The bug sat in Microsoft’s service, so some of the relevant evidence may exist only in Microsoft’s own telemetry.

How SOCRadar Tracks Cloud CVEs

Hosted-service CVEs such as CVE-2026-109469 never show up in a vulnerability scan, because nothing in the customer environment needs fixing. They still matter for identity risk reviews and for catching later developments, such as a researcher write-up, a revised exploitation status or new detail on what the flaw exposed.

SOCRadar’s Vulnerability Intelligence tracks these records alongside conventional CVEs, including scoring and exploit status updates, so identity teams see when a mitigated cloud flaw gains new context. The broader Cyber Threat Intelligence module provides expanded context, tracking Entra ID-related adversary tactics like device code phishing schemes that result in rogue device registrations. Confirming whether an unexpected device was registered in a specific tenant still depends on that tenant’s own Entra audit logs.