Microsoft has disclosed a maximum-severity vulnerability in its Entra identity service, tracked as CVE-2026-109469, carrying a CVSS base score of 10.0. The flaw sits in Entra Device Registration, the service that lets users register devices so Conditional Access policies can treat them as trusted. Microsoft says the vulnerability has already been fully mitigated on its side and customers do not need to take any action.

The vulnerability is an authorisation bypass through a user-controlled key, classified as CWE-639. In plain terms, the service decided which record a device registration belonged to by looking at an identifier supplied by the client, without properly checking that the client was entitled to use it. Microsoft describes the flaw as allowing an unauthorised attacker over the network to elevate privileges. The CVSS vector — network-reachable, low complexity, no privileges required, no user interaction, with the impact spreading beyond the vulnerable component — is what produces the maximum score.

Microsoft published the CVE record on 6 November 2026, with the underlying advisory dated 5 November. At publication, the company assessed the flaw as not publicly disclosed and not exploited, with exploitation rated less likely. Its temporal score of 8.7 reflects that assessment: exploit code is unproven and an official fix already exists. As of 7 November, the flaw was not listed in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue, and no public proof-of-concept exploit had been indexed.

What makes this CVE unusual is that there is nothing for customers to patch. It carries Microsoft's exclusively-hosted-service tag, meaning the vulnerability lived in Microsoft's cloud service rather than in software installed on customer machines. There is no affected version to scan for and no update to deploy. The CVE exists for transparency: before this programme, cloud-service flaws were often fixed silently. Now they receive CVE numbers and scores, but customers cannot independently confirm whether the flaw was used against their tenant before the fix.

That gap matters because the component involved has a documented history of abuse. In 2024, the Storm-2372 group used device-code phishing to obtain tokens and register devices it controlled as if they belonged to victims, then used those registered devices to acquire tokens that Conditional Access treated as coming from a trusted endpoint. More recently, a red-team engagement by Cyderes Howler Cell showed how a phantom device registered through the same service could be used to mint a Primary Refresh Token, achieve Intune compliance without a compliant device, and map a path to Global Administrator — bypassing 78 Conditional Access policies along the way. CVE-2026-109469 is a different bug in the same component, and the component's history is why a 10.0 there deserves attention rather than a shrug.

Microsoft's advice is straightforward: do not hunt for an emergency patch or a build number, because none exists for this CVE. The practical lesson for administrators is instead about durable controls. Two Conditional Access policies would break the broader attack chain around device registration: blocking device code flow, which stops the phishing step that obtains registration tokens, and requiring multi-factor authentication for the register-or-join-devices user action, which forces an extra challenge at the registration step itself. In the Cyderes engagement, both policies existed in report-only mode and neither was enforced. Administrators should also audit recent device registrations for entries they cannot attribute, since a device object registered during the vulnerable window would persist in the directory after the fix unless someone revokes it.

The flaw is fixed, and Microsoft's assessment is that it was unlikely to have been exploited. But the advisory does not answer whether it was used against any particular tenant before mitigation, and Microsoft has published no breach notification or incident report. For organisations that rely on Entra ID, the CVE is a reminder that a maximum score and a low likelihood can both be true at once — and that the controls worth checking are the ones that protect the identity chain regardless of which specific flaw comes next.