Introduction
Microsoft has disclosed an authorization bypass in Entra Device Registration, the service that creates device identities and writes device objects into Microsoft Entra ID, and scored it at the maximum CVSS 3.1 base score of 10.0. For defenders, Microsoft reports the flaw as already fully mitigated on its own infrastructure. That makes this a transparency disclosure for a cloud service rather than an instruction to deploy an update.
In this short review we summarize what the advisory confirms, how to read a 10.0 base score next to a completed fix, and which details Microsoft has not published.
Technical information
Root cause class
Microsoft's description is brief: "Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network." Microsoft is the assigning CNA and classifies the impact as Elevation of Privilege.
The weakness is mapped to CWE 639, Authorization Bypass Through User Controlled Key. MITRE defines this as a failure to prevent a user from accessing another user's data or record by modifying the key that identifies it. The underlying failure is that the application does not adequately verify whether the requester is entitled to perform the requested operation. MITRE notes that this class can lead to horizontal privilege escalation and, in some implementations, vertical escalation to administrative access. Those are properties of the weakness class, not confirmed outcomes for this CVE.
In practical terms, bugs in this class follow a familiar pattern. The server accepts an identifier from the client (for example a device ID, object ID, or tenant reference) and acts on the referenced object without checking that the caller is allowed to use it. "Key" here means a lookup value in the authorization sense. Nothing in the advisory indicates that cryptographic key material was stolen or compromised, and Microsoft does not name the specific device identifier, request field, URL parameter, or API endpoint involved.
Why Device Registration is a sensitive place for this bug
Microsoft's architecture documentation describes a Microsoft Entra joined flow in which the client submits an identity token and registration material to the Device Registration Service. The service validates the token, creates a device identity and certificate, and writes a device object into Microsoft Entra ID. Device objects feed into identity decisions across the tenant, so an authorization error in this component sits close to trust boundaries. The documentation establishes the role of the component. It does not tell us which operation was vulnerable.
CVSS vector
Microsoft publishes the following base vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Reading the metrics as Microsoft defines them:
- Attack Vector: Network. Exploitation is possible through the network stack.
- Attack Complexity: Low. No specialized access conditions are required.
- Privileges Required: None. The attacker needs no prior privileges.
- User Interaction: None. No other user has to take any action.
- Scope: Changed. Impact can extend beyond the security authority of the vulnerable component.
- Confidentiality, Integrity, Availability: High. Potential impact in each category is high.
These values describe assessed potential consequences, not losses observed in an incident. Scope Changed in particular does not establish cross-tenant compromise, and the advisory does not identify a tenant boundary or the role an attacker would end up holding.
Microsoft also publishes a temporal score of 8.7:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
The temporal metrics are Exploit Code Maturity Unproven, Remediation Level Official Fix, and Report Confidence Confirmed. The temporal score supplements the 10.0 base score and does not replace it.
Attack flow, as far as the public record supports it
Microsoft has not released an exploitation procedure, so the sequence below is limited to what the CWE mapping and CVSS vector imply:
- An attacker with no prior privileges sends a request to the Entra Device Registration service over the network, with no user interaction required (AV:N, PR:N, UI:N).
- The request carries an identifier that the service uses to locate an object. The actual parameter is undisclosed.
- Before the fix, the service acted on that client-supplied key without verifying that the referenced object belonged to the caller's authenticated principal or tenant.
- The outcome was elevation of privilege, with impact Microsoft scores as reaching beyond the vulnerable component (S:C) and high confidentiality, integrity, and availability impact.
The public record does not confirm remote code execution, Global Administrator access, unrestricted tenant takeover, or any particular data exfiltration outcome.
Exploitation status
Microsoft's advisory records the following at publication:
- Exploited: No
- Publicly disclosed: No
- Exploitability assessment: Exploitation Less Likely
- Exploit maturity: Unproven
- Acknowledgment: Thomas Knudson with Microsoft, which indicates internal discovery
No threat actor or campaign is attributed to this CVE. The available material does not establish CISA KEV status. The catalog snapshot we reviewed is timestamped November 6, 2026 at 19:44:45 UTC, before the CVE record was published at 23:06:41 UTC.
For context, MITRE ATT&CK technique T1098.005 (Account Manipulation: Device Registration) documents APT29 enrolling its own devices into compromised cloud tenants, including enrolling a device for MFA in an Azure AD environment after guessing the password of a dormant account, and Scattered Spider registering devices for MFA to persist through VPN access. Both cases relied on compromised identities. Neither actor is linked to CVE-2026-109469, and because this vector requires no privileges and no user interaction, controls aimed at credential-based enrollment abuse should not be assumed to block this specific path.
Publication chronology
- MSRC advisory: released November 5, 2026 (revision 1.0)
- CVE record: published November 6, 2026 at 23:06:41.546 UTC
- NVD record: published November 6, 2026, status Awaiting Enrichment
Patch information
Microsoft fixed this on its own servers. There is no binary, KB article, or build number to deploy. NVD lists Entra Device Registration as an Exclusively Hosted Service, so the vulnerable code ran only on Microsoft's infrastructure, and the fix was applied there.
What Microsoft has published
- The MSRC advisory (revision 1.0, November 5, 2026) is marked: "The vulnerability documented by this CVE requires no customer action to resolve."
- The advisory FAQ explains the absence of an update link. The issue "has already been fully mitigated by Microsoft," and the CVE is published for transparency under Microsoft's cloud service CVE program.
- The Security Updates table contains a single row for Entra Device Registration with the Article, Download, and Build Number fields blank, which is expected for a fix applied in the service.
- The temporal vector sets Remediation Level to Official Fix (RL:O), which contributes to the drop from a 10.0 base to an 8.7 temporal score. Microsoft considers the fix complete, not a temporary workaround.
What the fix probably involved
Microsoft has not released code, a diff, or a technical writeup, so the exact change cannot be verified. The CWE 639 classification does indicate the kind of change required. The standard remediation for this class moves the authorization decision to the server:
- Treat any identifier the client supplies as untrusted input.
- Before reading or changing the object, confirm that it belongs to the caller's authenticated principal or tenant, based on the caller's validated token rather than values in the request.
- Refuse the request if that check fails, instead of trusting the key.
MITRE's guidance for the class says much the same: verify the requester's privileges for every data access, and ensure lookup keys cannot be externally controlled or that tampering can be detected. Given the vector (AV:N, PR:N, S:C), the fix would have needed to add or enforce an ownership and authorization check ahead of any record lookup. This is an inference from the weakness class, not a description of Microsoft's actual change.
How to verify it
Customers cannot install anything, check a version, or confirm the fix inside their own tenant. The only evidence is Microsoft's statement on the MSRC page, which NVD references as its sole remediation source. Scanning endpoints for a missing KB will not detect this vulnerability or its fix.
Separating remediation from general hygiene
Microsoft's Entra security operations guidance documents controls that are useful in their own right: requiring MFA to register or join devices, alerting on successful Device Registration Service authentication marked "No MFA required", monitoring changes to policies that require joined or compliant devices, trusted locations, and MFA exceptions, monitoring additions to the Global Administrator and Microsoft Entra Joined Device Local Administrator roles, and removing stale devices so their primary refresh tokens cannot be used. None of these is identified as a fix or prerequisite for this CVE, and neither role is confirmed as the privilege gained through it.
Affected systems and versions
- Product: Microsoft Entra Device Registration
- Deployment model: Exclusively Hosted Service (per NVD). The vulnerable code ran only on Microsoft infrastructure.
- Versions and builds: none published. The MSRC Security Updates table lists no Article, Download, or Build Number.
- Vulnerable configurations: the advisory does not identify specific tenant configurations, endpoints, or parameters
- Customer-installed software: no customer-installed component is listed as affected
The CVE data we received listed the vendor as Unknown. NVD and the MSRC advisory identify the vendor as Microsoft.
Vendor security history
Microsoft Entra ID, formerly Azure Active Directory, is Microsoft's identity and access management platform, covering single sign on, MFA, Conditional Access, passwordless authentication, identity protection, and privileged identity management. Microsoft reports being named a Leader in The Forrester Wave: Workforce Identity Security Platforms, Q2 2026, with the highest scores in the current offering and strategy categories. That is a Microsoft-published account of analyst recognition, not a market share figure or evidence that any particular service is free of vulnerabilities.
The Cyber Safety Review Board's review of the Summer 2023 Microsoft Exchange Online intrusion provides an independent counterpoint. The Board attributed the intrusion to an actor associated with the government of the People's Republic of China, described access to email accounts of senior US government officials, and concluded that the intrusion should never have happened and resulted from a cascade of security failures at Microsoft. Its recommendations included a public reform plan with accountability, treating security as a design requirement, and making security logging a core cloud capability rather than a paid add on. That case concerns Exchange Online and has no technical or attribution link to CVE-2026-109469.
Microsoft's July 2026 Secure Future Initiative progress report describes self-reported changes including stronger tenant boundaries and least privilege, safer credential defaults, expanded critical security logging, and central governance of important build pipelines. The report does not connect these changes to the discovery or remediation of this CVE, although the internal credit on this advisory is consistent with Microsoft finding and fixing the issue itself.
References
- MSRC Security Update Guide: CVE-2026-109469, Entra Device Registration Elevation of Privilege Vulnerability
- NVD: CVE-2026-109469
- CVE Record: CVE-2026-109469
- CVE Services API record for CVE-2026-109469
- MITRE CWE 639: Authorization Bypass Through User Controlled Key
- Microsoft Learn: How Microsoft Entra device registration works
- Microsoft Learn: Security operations for devices
- Microsoft Entra ID product overview
- MITRE ATT&CK T1098.005: Account Manipulation, Device Registration
- MITRE ATT&CK DET0036: Suspicious Device Registration via Entra ID or MFA Platform
- CISA Known Exploited Vulnerabilities catalog feed
- Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion
- DHS: Cyber Safety Review Board releases report on the Summer 2023 Microsoft Exchange Online incident
- Microsoft Security Blog: Microsoft recognized as a Leader in The Forrester Wave for Workforce Identity Security Platforms
- Microsoft Trust Center: Secure Future Initiative Progress Report, July 2026
- VulDB: CVE-2026-109469 in Entra Device Registration
