Loading vulnerability…
Authorization Bypass and Privilege Escalation in Microsoft Entra Device Registration
CVE-2026-109469 is an authorization bypass through a user-controlled key in Microsoft Entra Device Registration, an exclusively hosted service. An unauthenticated remote attacker can exploit the vulnerability to elevate privileges without user interaction. The vulnerability has a CVSS v3.1 base score of 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Microsoft has completed service-side remediation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthorized remote privilege escalation. The CVSS assessment indicates changed security scope and high impacts to confidentiality, integrity, and availability. The resulting privilege level, accessible resources, and precise scope of access are not specified.
If you can’t patch tonight, do this now.
Microsoft has fully mitigated the vulnerability in the service. No customer action or workaround is required.
Patch, then assume compromise.
Microsoft has completed remediation in the hosted service. Customers do not need to install updates or make configuration changes. No fixed version identifiers are provided.
No public exploits tracked yet. Mallory keeps watching.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.