CVE-2026-109469 - Microsoft Entra Device Registration Elevation of Privilege (CVSS 10.0)

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5650 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-109469 Follow-On - Registered Owner/User Added to Multiple Entra Devices

Detects an initiator adding registered owners or registered users to 3+ Entra devices within 24 hours (audit activities 'Add registered owner to device' and 'Add registered users to device'). After a Device Registration authorization bypass, attackers could attach identities to device objects to persist (T1098.005, parent T1098) and then sign in as valid cloud accounts (T1078.004). Inferred from the vulnerability class; not a confirmed CVE-specific indicator.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1098.005, T1098, T1078.004
• Data sources: azure_ad_audit_logs: index=azure sourcetype=azure:monitor:aad category=AuditLogs, Microsoft Sentinel AuditLogs table, Entra ID audit logs (Device Registration Service)
• Severity: medium
• Confidence: medium

Splunk SPL

index=azure sourcetype=azure:monitor:aad category=AuditLogs properties.loggedByService="Device Registration Service" operationName IN ("Add registered owner to device","Add registered users to device") | eval initiator=coalesce('properties.initiatedBy.user.userPrincipalName','properties.initiatedBy.app.displayName',"NO_INITIATOR") | eval owner_upn='properties.targetResources{}.userPrincipalName' | bin _time span=24h | stats count AS assignments values(owner_upn) AS assigned_identities values(operationName) AS ops values(correlationId) AS correlation_ids BY _time initiator | where assignments>=3

Microsoft KQL

AuditLogs
| where TimeGenerated > ago(24h)
| where LoggedByService == 'Device Registration Service'
| where OperationName in ('Add registered owner to device','Add registered users to device')
| extend Initiator = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName), 'NO_INITIATOR'), InitiatorIp = tostring(InitiatedBy.user.ipAddress)
| summarize Assignments = count(), Operations = make_set(OperationName), CorrelationIds = make_set(CorrelationId, 25) by Initiator, InitiatorIp, bin(TimeGenerated, 24h)
| where Assignments >= 3

Sigma

title: Entra Registered Owner or User Added to Device (CVE-2026-109469 Follow-On)
id: 6b0e5a1c-3d52-4f0b-9a7e-5650a0000002
status: experimental
description: Detects assignment of a registered owner or registered user to an Entra device object, a persistence pointer (Device Registration account manipulation) after possible abuse of CVE-2026-109469. Correlate volume and initiator in the SIEM; this rule alone is a low-fidelity hunting signal.
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109469
    - https://attack.mitre.org/techniques/T1098/005/
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.persistence
    - attack.t1098
    - attack.t1098.005
    - attack.defense-evasion
    - attack.t1078.004
    - cve.2026-109469
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        properties.loggedByService: 'Device Registration Service'
        properties.message:
            - 'Add registered owner to device'
            - 'Add registered users to device'
    condition: selection
falsepositives:
    - Help-desk or Intune/Autopilot workflows assigning primary users to devices
    - Employee device replacement and tenant migrations
level: medium

Known false positives:

• Help-desk staff or Intune/Autopilot assigning primary users to many devices
• Device refresh cycles and merger/tenant-migration projects

Tuning notes: Exclude known help-desk and provisioning accounts, and raise or lower the assignments>=3 threshold per tenant baseline. Review matched device objects against Get-MgDevice inventory (trustType, registrationDateTime) and Intune/Autopilot enrollment records. Treat assignments to privileged users, or by initiators with no prior device-management activity, as higher priority.

• 🔒 CVE-2026-109469 Follow-On - New Entra Device Followed by Sign-In From Different IP (Sentinel) · unlock with TL Creds
• 🔒 CVE-2026-109469 Follow-On - Bulk Entra Device Enumeration via Microsoft Graph (Sentinel) · unlock with TL Creds
• 🔒 CVE-2026-109469 Follow-On - Entra Device Deletion Burst or Initiator-Less Delete (Sentinel) · unlock with TL Creds
• 🔒 CVE-2026-109469 Entra Device Registration Bypass Indicators - Sigma Primary · unlock with TL Creds
• 🔒 CVE-2026-109469 Risky Successful Sign-In to Device Registration Service - Sigma Primary · unlock with TL Creds
• 🔒 CVE-2026-109469 Follow-On - Conditional Access Policy Update or Deletion - Sigma Primary · unlock with TL Creds
• 🔒 CVE-2026-109469 Entra Device Registration Service Activity With No Initiator or Mass Object Touch · unlock with TL Creds
• 🔒 CVE-2026-109469 Follow-On - Conditional Access Policy Tampering on Register or Join Devices · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-5650.

Technical analysis

CVE-2026-109469 was published by Microsoft (secure@microsoft.com CNA) on 2026-11-06 (reserved 2026-10-12, date public 2026-11-05). The record, titled "Entra Device Registration Elevation of Privilege Vulnerability", describes an "Authorization bypass through user-controlled key in Entra Device Registration" that allows an unauthorized attacker to elevate privileges over a network. The weakness is CWE-639. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (base 10.0; exploitability sub-score 3.9, impact sub-score 6.0); OpenCVE shows temporal metrics E:U/RL:O/RC:C, and Penligent reports a temporal score of 8.7. NVD status was Awaiting Analysis at last check, with CPE cpe:2.3:a:microsoft:entra_device_registration:*:*:*:*:*:*:*:* and no version ranges.

The record is tagged as an exclusively hosted service. Microsoft Entra Device Registration is a Microsoft-operated cloud component, so there is no customer-installable patch, KB or build number. A third-party write-up (Penligent, 2026-11-08), which cites MSRC revision 1.0, reports that Microsoft states the vulnerability has already been fully mitigated and that users of the service have no action to take, and that Microsoft rates it not publicly disclosed, not exploited, exploitation less likely. We could not fetch the MSRC advisory directly (the page returned only a title), so this remediation statement is secondary-sourced. OpenCVE's generic advice (install latest update, restrict API access to trusted networks, network segmentation, extensive logging of registration attempts) is AI-generated and is not vendor guidance; its statement that impact would be system-wide on a domain controller is likewise an inference, not a vendor claim.

Microsoft has not published the vulnerable endpoint, the user-controlled key, the request format, the privilege boundary crossed, the object type affected, the affected tenant count or exposure interval, or any CVE-specific log signature or indicator of compromise. The record is not listed in CISA KEV, has no SSVC data, and EPSS is about 0.67% (0.00668). No public PoC, threat actor, malware, or network IOCs are associated with it in any verified source. Because the technical mechanism is undisclosed, the MITRE ATT&CK mappings below are inferential from the vulnerability class (network-reachable cloud identity service, privilege elevation, device registration) rather than observed adversary behavior. The IOC entries are monitoring pointers (Entra Device Registration audit activities, the Device Registration Service audit filter, Graph query tooling and Conditional Access control points named in secondary sources), not confirmed indicators of compromise. Penligent notes the audit activities are useful for reconstructing changes but are not a detector for this CVE. Defenders should treat an empty audit search as inconclusive rather than proof of non-exposure, and should preserve correlation IDs, target object IDs, initiator data, Conditional Access results and sign-in records for any suspicious device object.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1078.004 Cloud Accounts

Persistence

T1098.005 Device Registration

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1556.009 Conditional Access Policies

Remediation

Patches

• Reportedly already fully mitigated by Microsoft server-side; no customer-installable patch, KB or build number published (secondary source; MSRC not directly verified)

Immediate actions

• Review the MSRC Update Guide entry for CVE-2026-109469 for the authoritative remediation status
• Review Entra audit logs (loggedByService eq 'Device Registration Service') for unexpected device add/update/delete and owner/user changes since early October 2026
• Check Microsoft Service Health, Message Center and support communications for tenant-specific notices
• Flag devices not explained by endpoint-management enrollment, BYOD, Autopilot/provisioning, mergers, test tenants, service accounts or help-desk activity, and preserve correlation IDs and target object IDs

Workarounds

• None published by Microsoft; OpenCVE generic suggestions (restrict API access to trusted networks, network segmentation, enhanced logging) are AI-generated, not vendor guidance

Longer-term hardening

• Alert on anomalous Entra device registration and registered-owner/user changes
• Review Conditional Access coverage of the Register or join devices user action against onboarding requirements (not a CVE fix; emergency changes can disrupt legitimate enrollment)
• Track CVE closure at provider-managed scope in vulnerability management tooling

Affected and fixed versions

• Microsoft — Microsoft Entra Device Registration (cloud service)
  Vulnerable versions: No version information published; exclusively hosted service
  Fixed in: Reportedly mitigated server-side by Microsoft; no customer action

Timeline

• 2026-10-12 CVE-2026-109469 identifier reserved by Microsoft (per CVE record via OpenCVE, 17:01 UTC).
• 2026-11-05 Date public recorded by the CNA (Microsoft) in the CVE record (16:00 UTC).
• 2026-11-06 NVD entry set to Awaiting Analysis; no affected or fixed version data, not listed in CISA KEV.
• 2026-11-06 Microsoft publishes CVE-2026-109469 and MSRC advisory revision 1.0; MITRE (23:06 UTC) and NVD (23:17 UTC) records published, CVSS 3.1 base 10.0.
• 2026-11-07 OpenCVE generates AI analysis with generic recommendations (00:50 UTC); not vendor guidance.
• 2026-11-08 Penligent reports Microsoft states the flaw is already fully mitigated server-side with no customer action, and that no vulnerable endpoint, tenant impact or detection signature has been published.
• 2026-11-09 OpenCVE enrichment updated (17:12 UTC); EPSS about 0.67%, no exploitation evidence, no KEV listing.

Sources cited

• OpenCVE - CVE-2026-109469 app.opencve.io · Advisory · 2026-11-06
• ThreatInt CVE record - CVE-2026-109469 cve.threatint.com · Advisory · 2026-11-06
• CVE.org record - CVE-2026-109469 CVE Program · Advisory · 2026-11-06
• Microsoft MSRC Update Guide - CVE-2026-109469 Microsoft Security Response Center · Vendor report · 2026-11-06
• Penligent - CVE-2026-109469 status on November 8, 2026 penligent.ai · Research · 2026-11-08
• Microsoft Learn - Microsoft Entra audit activities reference Microsoft · Vendor report
• Microsoft Learn - Graph directoryAudit list API Microsoft · Vendor report
• Microsoft Learn - Conditional Access cloud apps and user actions Microsoft · Vendor report
• SecurityOnline CVE Watchtower - CVE-2026-109469 securityonline.info · News · 2026-11-06

More in cloud

• AntiFox agentic AI pentest platform (ARTEX fork) abused in IIS webshell to AWS credential-theft intrusions
• Qubole Cross-Account Access Abused in the Wild: AWS Integration Role Assumption Campaign
• LLMjacking Bills Reach $1M (Mandiant/GTIG; LiteLLM CVE-2026-40217), Trezor Safe 5 Reseller Implant, SAP Flaws Weaponized Within Days
• Key Eater: Stolen Microsoft Entra ID Application Credentials Used to Breach 27 Organizations
• The Rise of LLMJacking: Threat Actors Monetize Compromised Cloud and Model Resources (UNC6993, D1337-KAIROS, CVE-2026-40217)

Other reports on CVE-2026-109469

• Microsoft Patch Tuesday November 2026: ~1,095 vulnerabilities, 64 critical, one exploited Outlook NTLM-leak spoofing zero-day (CVE-2026-124194)
• Microsoft November 2026 Patch Release: 1,093 Vulnerabilities Fixed, Outlook Spoofing Zero-Day CVE-2026-124194 Actively Exploited
• Microsoft November 2026 Patch Tuesday: Outlook Zero-Day CVE-2026-124194 Exploited to Steal NTLM Hashes (1,235 Flaws Fixed)