Microsoft Entra Device Registration: Authorization bypass via user-controlled key

Summary

Microsoft Entra Device Registration, part of the cloud identity service Microsoft Entra ID, contains an authorization bypass caused by a user-controlled key (CWE-639). According to the CVE record and the NVD vector (CVSS 3.1: 10.0, Critical), an unauthenticated attacker over the network can elevate privileges without user interaction. NVD analysis is pending and the Microsoft advisory could not be retrieved, so affected services, fix status and exploitation status are unconfirmed.

Affected

Unknown.

• Microsoft Entra Device Registration (per CVE record; versions not published in the sources reviewed)

Fixed in

Unknown. Check the Microsoft Security Update Guide advisory for fix status and whether a customer action is required.

Workaround

No vendor-issued workaround found.

• Restrict device registration to defined user groups.
• Enforce multi-factor authentication through Microsoft Entra Conditional Access.
• Apply enrollment restrictions and device limits in Microsoft Intune.

Exploitation

Unknown. No reports of in-the-wild exploitation, public proof of concept or CISA KEV listing were found at the time of research.

Our recommendation

• Verify the Microsoft advisory for affected services and required actions.
• Restrict device registration, enforce MFA and review device limits.
• Review Entra sign-in and audit logs for unexpected device registrations and new device objects, and review recent privileged role activity.
• Re-check the NVD entry and CISA KEV after analysis, as the CVSS score may change.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-109469 msrc.microsoft.com
• CloudCoffee: Secure device registration in Microsoft Entra www.cloudcoffee.ch

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 7 Nov 2026, 00:20.