Microsoft has disclosed a critical flaw in Entra Device Registration, the service organisations use to register devices so staff can sign in to company apps and cloud resources. The vulnerability, tracked as CVE-2026-109469, carries the maximum possible severity score of 10.0 out of 10.

The flaw is an authorisation bypass through a user-controlled key, classed as CWE-639. In plain terms, the registration process can be tricked into accepting a key supplied by an attacker, letting someone with no permission raise their own access level over the network. No login is needed and no user has to click anything: the severity rating records network access, low attack complexity, no privileges required and no user interaction.

What is at risk

Device registration sits at the heart of how companies control which laptops and phones may reach their cloud services, so a bypass there can open the door to wider access. An attacker who exploits the flaw could move around a victim organisation's systems more freely and reach data they should not see, including files and internal tools tied to the registered device.

No exploitation reported yet

The flaw was published on 6 November 2026 and, at the time of writing, is not known to have been exploited in the wild. It does not appear in the US cybersecurity agency CISA's catalogue of actively exploited flaws. The CVE record does not list a fixed version, so administrators should check Microsoft's advisory and review device registration settings to make sure only trusted keys are accepted.