10/10 CVSS on CVE-2026-109469: What We Know So Far

What is CVE-2026-109469?

Last updated: 9 November 2026

CVE-2026-109469 is a critical, maximum-impact vulnerability in Microsoft Entra Device Registration. It carries a CVSS 3.1 base score of 10.0 and is classed as an authorisation bypass through a user-controlled key (CWE-639), meaning an attacker could potentially elevate their privileges over the network with no authentication and no user interaction required. Microsoft publicly disclosed the flaw on 5 November 2026 and has already fixed it entirely on its own servers. Entra Device Registration is a Microsoft-hosted cloud service, so no customer patching is needed. Here's everything we know so far, and what's still unconfirmed.

In plain terms: this let a device trick Microsoft's trust system into treating it as something it wasn't. It happened entirely on Microsoft's side, so there's nothing for you to install. It's still worth a quick glance below if your organisation runs Microsoft 365 or Entra ID.

The key facts

All of the above comes from the official NVD record and MITRE CVE record. Both agree on the description, score and affected product.

In plain English: anyone on the internet could have triggered this, with no password and no clicks needed from a victim. A successful attack would have handed over full control, which is why it maxes out the scoring scale.

How the vulnerability works

In everyday terms: this bug could have let an attacker's device pretend to be one it had no right to be, tricking Microsoft's system into trusting it when it shouldn't have. Technically, Microsoft classifies it as CWE-639, "Authorization Bypass Through User-Controlled Key." That's a flaw where a system uses an identifier or key supplied by the caller, rather than one it independently verifies, to decide what that caller is allowed to access or do. In the context of Entra Device Registration, the service that lets a device enrol itself into an organisation's Entra ID tenant, that typically means an attacker could supply or manipulate a device or registration identifier to act with permissions it shouldn't have.

Microsoft hasn't published the exact technical root cause, and no credible proof-of-concept has surfaced elsewhere. Most of what's circulating online just repeats the official description. The short version: this was exploitable by anyone on the internet, with no login details and no action needed from a victim, which is why it scored the maximum possible severity.

Timeline so far

A couple of third-party trackers list a 4 November release date instead; we've gone with the dates in the official MSRC, MITRE and NVD records above.

Is it being exploited, and do you need to do anything?

As of 9 November 2026, CVE-2026-109469 is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalogue, and we haven't seen any credible reports of it being exploited in the wild.

More importantly for anyone running Microsoft Entra ID: NVD tags this record "exclusively-hosted-service." That's a technical way of saying Entra Device Registration runs entirely on Microsoft's infrastructure, not in your tenant's own software stack. There's no patch, update or KB article for you to deploy. Microsoft fixed the vulnerability server-side, and the fix applies automatically to every tenant. There is nothing to install.

What Periculo recommends anyway

No patching is available, but given the severity score, it's worth a quick sense check:

• Review your Entra ID audit logs (filter by category Device) for any unexpected device registrations around late October or early November 2026.
• Check Devices → All devices in the Entra admin centre for anything unfamiliar, especially devices registered outside your normal onboarding process.
• Confirm your device-based Conditional Access policies are behaving as expected. This class of bug is exactly the kind that could let an untrusted device slip past a trust condition it shouldn't meet.
• Tidy up stale or unused registered devices while you're in there; it's good hygiene regardless of this CVE.

None of this is a required remediation step. It's a sensible 15-minute check given the severity score, not a response to any confirmed compromise.

Why this matters beyond this one CVE

Entra ID (formerly Azure AD) sits underneath almost everything else in a modern Microsoft environment. It's what decides who and what gets trusted, including the devices that feed into Conditional Access and zero-trust policies. A maximum-severity flaw in its device-trust layer is worth paying attention to even when it's fixed within days, because identity infrastructure is exactly the kind of system where a small authorisation bug can have an outsized blast radius.

For organisations working towards NHS DSPT, Defence Cyber Certification (DCC), or Cyber Essentials, identity and access management is routinely in scope for assurance activity. This is precisely the kind of advisory worth feeding into your next security review, internal audit, or penetration test scoping conversation. If you're not sure whether your Entra environment would hold up to that kind of scrutiny, that's a conversation worth having before an assessor, or an attacker, asks the question for you.

FAQs

Sources: MSRC advisory · NVD record · MITRE CVE record

Update (9 November 2026): We've linked Microsoft's official advisory above because it's the canonical reference both NVD and MITRE cite for this CVE. That advisory page requires JavaScript and didn't render for our research tools, so the facts in this post are drawn from the NVD and MITRE CVE databases, which independently agree on the description, score and affected product.