CVE-2026-109469 · Vendor
NO FIX YET
Microsoft Entra Device Registration trusts a user-controlled key, which lets an unauthorized attacker bypass authorization. Per the NVD description, the attacker can elevate privileges over the network.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations that use Microsoft Entra ID device registration (Entra join, hybrid join, registered devices) are the likely exposure. The NVD text says an unauthorized attacker can elevate privileges over the network with no user interaction. Affected configurations, required privileges and whether Microsoft already fixed it in the cloud are not confirmed in a primary source I could read. unknown
Who cares device-registration, entra-id, microsoft-entra
No fix yet, per the sources.
Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.