Microsoft Mitigates CVSS 10 Entra Device Registration Flaw
Summary
CVE-2026-109469 is an authorization-bypass flaw in Entra Device Registration that could allow unauthenticated remote privilege escalation. Microsoft says it has mitigated the issue; no customer patch is needed, and no exploitation has been reported.
Key points
- Microsoft describes CVE-2026-109469 as a CVSS 10.0 authorization bypass involving a user-controlled key, mapped to CWE-639.
- The flaw could allow an unauthenticated attacker to elevate privileges over a network, but Microsoft has provided few technical details about the identifier, endpoint, or potential privileges.
- Microsoft says the service-side issue is fully mitigated; customers have no patch or configuration change to apply.
- Microsoft lists the flaw as not exploited and not publicly disclosed, with exploitation assessed as less likely. The article notes Microsoft has not said whether it checked for earlier abuse.
- The article says there is no public proof of concept or technical write-up and no published indicators of compromise.
- Suggested tenant-side checks include reviewing device registration activity, registration permissions, device objects, and unusual registration bursts; these are general hunting ideas, not Microsoft guidance for this CVE.
- The article says there is no known link between CVE-2026-109469 and Storm-2372 or any other actor.
Article Details
- Vulnerability Types
- Authorization bypass through a user-controlled key
- Elevation of privilege
- Severity
- Critical (CVSS 10.0)
- Exploitation Status
- not_reported
- Exploit Availability
- none_reported
- Patch Status
- available
MITRE ATT&CK
CVE
Threat Actors
Midnight BlizzardMicrosoft assesses Storm-2372 as an initial access sub-cluster of Midnight Blizzard; the article does not link either to CVE-2026-109469.Storm-2372Microsoft research described Storm-2372 registering its own device in Entra ID after device code phishing and obtaining a Primary Refresh Token to reach organizational resources. The article explicitly says the activity is not linked to CVE-2026-109469.
Vendors
Products
Conditional AccessDevice identities are a prerequisite for device-based Conditional Access, so a device’s registration state can decide whether a sign-in satisfies a policy.Entra Device RegistrationMicrosoft has disclosed CVE-2026-109469, a critical elevation of privilege vulnerability in Entra Device Registration, the cloud service that registers and joins devices to Microsoft Entra ID.Microsoft Entra IDMicrosoft has disclosed CVE-2026-109469, a critical elevation of privilege vulnerability in Entra Device Registration, the cloud service that registers and joins devices to Microsoft Entra ID.