Security November 2026 Latest record Entra Device Registration Elevation of Privilege Vulnerability Recorded 7 Nov 2026 at 16:12 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position.
See the latest record .
CVE Microsoft Security Response Center
Entra Device Registration Elevation of Privilege Vulnerability Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.
CVE CVE-2026-109469
Severity Critical
CVSS base score 10.0
CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
Impact Elevation of Privilege
Exploitation detected No known exploitation (MSRC assessment)
Publicly disclosed No (MSRC assessment)
Exploitability Exploitation Less Likely
Component Entra Device Registration
Weakness CWE-639: Authorization Bypass Through User-Controlled Key
Issued by Microsoft
Customer action Not required (service-side fix)
Affected products Entra Device Registration
Updates that fix it No KB listed
CISA KEV Not listed in the collected catalog
EPSS 0.7%; scored 7 Nov 2026
Public detection template No Nuclei template listed
Published 5 Nov 2026 08:00 UTC
Last revised 5 Nov 2026 08:00 UTC
Revision note Information published.
Microsoft security releases Complete at observationRead 7 Nov 2026 at 16:11 UTC
CISA KEV Complete at observationRead 7 Nov 2026 at 16:11 UTC
FIRST EPSS Complete at observationRead 7 Nov 2026 at 16:11 UTC
Public detection templates (Nuclei) Complete at observationRead 7 Nov 2026 at 16:11 UTC Coverage describes the sources at this observation. A complete read then does not establish their current position.
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
Cite this version Field-level log (1)
Up to 100 recent field edits are shown; older edits may be outside retention.
7 Nov 2026 · 16:12:44 UTC
EPSS No EPSS score collected → 0.7%; scored 7 Nov 2026