{"id":"CVE-2026-109469","published":"2026-11-06T23:17:20.557","lastModified":"2026-11-11T02:17:07.633","description":"Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109469","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An authorization bypass flaw in Entra Device Registration lets an unauthenticated attacker use a user-controlled key to gain elevated privileges over the network, fully compromising confidentiality, integrity, and availability.","exploitability":"Exploitation requires network access and no authentication; it is straightforward for a remote attacker due to the lack of input validation on a critical authorization decision point.","blast_radius":"Successful exploitation grants full system compromise, enabling attackers to impersonate any user, modify device registration data, and potentially pivot laterally across the tenant.","remediation":"Upgrade to Entra Device Registration patch level 2026-Q1 or later, as specified in Microsoft Security Advisory ADV26-109469; if unavailable, disable device registration functionality until patched.","detection":"Monitor Azure AD audit logs for 'DeviceRegistration' events with anomalous privilege escalation (e.g., 'Add member to role' or 'Update device' actions performed by non-administrative accounts); also watch for repeated failed registration attempts followed by successful high-privilege operations from the same IP.","tags":["auth-bypass","privilege-escalation","entra","device-registration","network-exploitable"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:43:24.273Z"}}