CVE-2026-109469: CVSS 10 Entra Device Registration Flaw

Socradar •Yağmur Ernalbant • November 10, 2026

Microsoft has disclosed CVE-2026-109469, a critical elevation of privilege vulnerability in Entra Device Registration, the cloud service that registers and joins devices to Microsoft Entra ID. The flaw carries a maximum CVSS score, meaning that an unauthenticated attacker could exploit it over the network with no user interaction. Customers have nothing to patch. Microsoft says […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-109469 in Entra Device Registration: No User Action Required On November 5, 2026, Microsoft disclosed CVE-2026-109469, a critical vulnerability in Entra Device Registration, scoring 10.0 on the CVSS scale. This vulnerability allows unauthorized attackers to elevate privileges over a network through an authorization bypass. Microsoft has stated that the flaw was mitigated on their side before disclosure, meaning no patch is required from users. Financial institutions using Microsoft 365 are primarily affected, although the vulnerability was not publicly disclosed or exploited at the time of the announcement. The National Vulnerability Database listed the CVE on November 6, 2026, as awaiting analysis. Microsoft has not provided specific indicators for detection or hunting related to this vulnerability. 3 sources 69

Extracted Entities

CVE-2026-109469: CVSS 10 Entra Device Registration Flaw

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)