Is CVE-2026-109469 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109469 being exploited in the wild.

How severe is CVE-2026-109469?

Critical severity, with a CVSS score of 10, published 6 November 2026.

Is there a fix for CVE-2026-109469?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-109469 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-109469?

Check whether you run Microsoft Entra Device Registration. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109469: Microsoft Entra Device Registration authorization bypass in key validation

CVE-2026-109469 · Severity: critical · CVSS 10 · Published 2026-11-06

Microsoft Entra Device Registration, which manages corporate device identity and access, contains a flaw that allows an attacker to bypass authorization checks by manipulating a cryptographic key parameter. An attacker can exploit this over the network to gain unauthorized access and escalate privileges, potentially compromising device and user security across an organization.

Vendors: Microsoft.

Quick answers

Is CVE-2026-109469 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109469 being exploited in the wild.
How severe is CVE-2026-109469?: Critical severity, with a CVSS score of 10, published 6 November 2026.
Which products and versions are affected?: Microsoft Entra Device Registration.
Is there a fix for CVE-2026-109469?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109469 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-109469?: Check whether you run Microsoft Entra Device Registration. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass vulnerability in Entra Device Registration stems from insufficient validation of a user-controlled cryptographic key used in the registration or authentication process. The flaw allows unauthenticated or low-privileged attackers to supply a crafted key value that bypasses authorization checks, leading to privilege escalation over the network without requiring valid credentials or user interaction.

Affected products

Microsoft Entra Device Registration

Timeline

2026-11-06: disclosed

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109469

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.