CVE-2026-109469: Entra Device Registration Elevation of Privilege Vulnerability
Published Nov 5, 2026
·Updated
Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.
Other sources
Entra Device Registration Elevation of Privilege Vulnerability
— Microsoft
Affected Software
1 affected component
Microsoft Entra Device Registration
Event History
Nov 5, 2026
CVE Published
via Microsoft·04:00 PM
Data Sourced
via Microsoft·04:00 PM
DescriptionSeverityWeaknessAffected Software
Nov 6, 2026
CVE Published
via MITRE·11:06 PM
Data Sourced
via MITRE·11:06 PM
DescriptionSeverity
Data Sourced
via NVD·11:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require the attacker to be authorized in Entra Device Registration?
The issue is described as allowing an unauthorized attacker to elevate privileges over a network through an authorization bypass involving a user-controlled key.