Myabt

Critical CVE-2026-109469 in Entra Device Registration: No User Action Required

First seen 9 Nov 2026, 15:39 UTC • •69.0

Article Content

1 / 9

Browse articles

ThreatCluster •November 9, 2026 at 15:39 UTC

•CVE-2026-109469 has a CVSS score of 10.0, indicating critical severity.
•No user action is required as Microsoft has already mitigated the vulnerability.
•The vulnerability involves an authorization bypass allowing privilege escalation.

On November 5, 2026, Microsoft disclosed CVE-2026-109469, a critical vulnerability in Entra Device Registration, scoring 10.0 on the CVSS scale. This vulnerability allows unauthorized attackers to elevate privileges over a network through an authorization bypass. Microsoft has stated that the flaw was mitigated on their side before disclosure, meaning no patch is required from users. Financial institutions using Microsoft 365 are primarily affected, although the vulnerability was not publicly disclosed or exploited at the time of the announcement. The National Vulnerability Database listed the CVE on November 6, 2026, as awaiting analysis. Microsoft has not provided specific indicators for detection or hunting related to this vulnerability.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 1d ago How this analysis works

Timeline

2026-11-05

CVE-2026-109469 disclosed

Microsoft announced a critical vulnerability in Entra Device Registration with a CVSS score of 10.0, which has been mitigated on their side.

Myabt

2026-11-06

CVE-2026-109469 listed in NVD

The National Vulnerability Database picked up the CVE and listed it as awaiting analysis.

Myabt

Threat Graph

15 entities, 28 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Privilege Escalation
Zero-day Exploit
T1068 - Exploitation for Privilege Escalation

Campaign (1)

Microsoft 365 Token Replay Campaign

Organization (2)

ABT
Microsoft

Vulnerability (3)

CVE-2026-109469
Entra Device Registration Elevation Of Privilege Vulnerability
Entra Device Registration Flaw

Weakness (2)

CWE-269 - Improper Privilege Management
CWE-639 - Authorization Bypass Through User-Controlled Key (IDOR)

Affected Platform (4)

Active Directory
Entra ID
Microsoft 365
Microsoft Entra ID

Relationships

CVE-2026-109469 targets Active Directory
CVE-2026-109469 targets Entra ID
CVE-2026-109469 targets Microsoft 365
CVE-2026-109469 targets Microsoft Entra ID
Entra Device Registration Elevation Of Privilege Vulnerability targets Active Directory
Entra Device Registration Elevation Of Privilege Vulnerability targets Entra ID
Entra Device Registration Elevation Of Privilege Vulnerability targets Microsoft 365
Entra Device Registration Elevation Of Privilege Vulnerability targets Microsoft Entra ID
Entra Device Registration Flaw targets Active Directory
Entra Device Registration Flaw targets Entra ID
Entra Device Registration Flaw targets Microsoft 365
Entra Device Registration Flaw targets Microsoft Entra ID
Privilege Escalation targets Active Directory
Privilege Escalation targets Entra ID
Privilege Escalation targets Microsoft 365
Privilege Escalation targets Microsoft Entra ID
Zero-day Exploit targets Active Directory
Zero-day Exploit targets Entra ID
Zero-day Exploit targets Microsoft 365
Zero-day Exploit targets Microsoft Entra ID
T1068 - Exploitation for Privilege Escalation targets Active Directory
T1068 - Exploitation for Privilege Escalation targets Entra ID
T1068 - Exploitation for Privilege Escalation targets Microsoft 365
T1068 - Exploitation for Privilege Escalation targets Microsoft Entra ID
Microsoft 365 Token Replay Campaign related to ABT
Microsoft 365 Token Replay Campaign related to Microsoft
Microsoft 365 Token Replay Campaign related to CWE-269 - Improper Privilege Management
Microsoft 365 Token Replay Campaign related to CWE-639 - Authorization Bypass Through User-Controlled Key (IDOR)