{"id":"CVE-2026-109469","kind":"vulnerability","aliases":["CVE-2026-109469"],"related":[],"title":"Entra Device Registration: authorization bypass lets attacker elevate privileges over network","description":"Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.","summary":"Microsoft Entra Device Registration trusts a user-controlled key, which lets an unauthorized attacker bypass authorization. Per the NVD description, the attacker can elevate privileges over the network.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["device-registration","entra-id","microsoft-entra","vendor"],"not_affected_if":[],"how_to_check":"unknown: Microsoft has not published checkable details I could read. Entra Device Registration is a cloud service, so check the MSRC Security Update Guide entry for CVE-2026-109469 for whether Microsoft fixed it service-side and whether customers must act.","fix":null,"status":"open","published_at":"2026-11-06T23:17:20+00:00","first_seen_at":"2026-11-06T23:44:35+00:00","triaged_at":"2026-11-06T23:45:08+00:00","updated_at":"2026-11-06T23:45:49+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-11-06T23:45:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Entra Device Registration: authorization bypass lets attacker elevate privileges over network","impact":"high","summary":"Microsoft Entra Device Registration trusts a user-controlled key, which lets an unauthorized attacker bypass authorization. Per the NVD description, the attacker can elevate privileges over the network.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["entra-id","microsoft-entra","device-registration"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker gains elevated privileges over the network in Entra","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-109469 for affected services, required privileges, and whether a cloud-side fix is already applied.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations that use Microsoft Entra ID device registration are the likely exposure; the sources do not list affected versions or configurations. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000627,"input_tokens":4169,"output_tokens":420,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-109469 for affected services, required privileges, and whether a cloud-side fix is already applied.","search":"'-109469':14A,17A '-2026':13A,16A 'allow':68C 'attack':7A,42B,50B,71C 'author':4A,44B,57C 'bypass':5A,43B,58C 'control':36B,62C 'cve':12A,15A 'descript':48B 'devic':2A,19B,30B,66C 'device-registr':18B 'elev':8A,52B,73C 'entra':1A,22B,26B,29B,65C 'entra-id':21B 'id':23B 'key':37B,63C 'let':6A,39B 'microsoft':25B,28B 'microsoft-entra':24B 'network':11A,56B,77C 'nvd':47B 'per':45B 'privileg':9A,53B,74C 'registr':3A,20B,31B,67C 'trust':32B 'unauthor':41B,70C 'user':35B,61C 'user-control':34B,60C 'vendor':27B","nicknames":[],"mitigations":[],"who_affected":"Organizations that use Microsoft Entra ID device registration (Entra join, hybrid join, registered devices) are the likely exposure. The NVD text says an unauthorized attacker can elevate privileges over the network with no user interaction. Affected configurations, required privileges and whether Microsoft already fixed it in the cloud are not confirmed in a primary source I could read. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","deviceregistration","entraid","microsoftentra","vendor"],"campaign_type":null,"search_a":"'-109469':14A,17A '-2026':13A,16A 'attack':7A 'author':4A 'bypass':5A 'cve':12A,15A 'devic':2A 'elev':8A 'entra':1A 'let':6A 'network':11A 'privileg':9A 'registr':3A","search_b":"'attack':42B,50B 'author':44B 'bypass':43B 'control':36B 'descript':48B 'devic':19B,30B 'device-registr':18B 'elev':52B 'entra':22B,26B,29B 'entra-id':21B 'id':23B 'key':37B 'let':39B 'microsoft':25B,28B 'microsoft-entra':24B 'network':56B 'nvd':47B 'per':45B 'privileg':53B 'registr':20B,31B 'trust':32B 'unauthor':41B 'user':35B 'user-control':34B 'vendor':27B","search_c":"'allow':68C 'attack':71C 'author':57C 'bypass':58C 'control':62C 'devic':66C 'elev':73C 'entra':65C 'key':63C 'network':77C 'privileg':74C 'registr':67C 'unauthor':70C 'user':61C 'user-control':60C","first_public_at":"2026-11-06T23:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109469","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109469","severity":null,"published_at":"2026-11-06T23:17:20+00:00","modified_at":"2026-11-06T23:17:20+00:00","first_seen_at":"2026-11-06T23:44:35+00:00","fetched_at":"2026-11-06T23:44:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109469:1939","url":null,"severity":null,"published_at":"2026-11-06T23:45:49+00:00","modified_at":"2026-11-06T23:45:49+00:00","first_seen_at":"2026-11-06T23:45:49+00:00","fetched_at":"2026-11-06T23:45:49+00:00","note":"MSRC page is JS-only (empty via web-cli) and CVRF API returned no CVE content; only NVD text (CVSS 10.0, AV:N/PR:N, scope changed) and a third-party mirror (Entra Device Registration, no known exploitation) available. Affected versions, cloud-side fix status, required privileges unconfirmed; nothing verified. Revisit with browser-cli on MSRC or when Microsoft's advisory text is indexed."}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}