# CVE-2026-109469 - Microsoft Entra Device Registration Elevation of Privilege (CVSS 10.0)

> CVE-2026-109469 is an authorization bypass through a user-controlled key (CWE-639) in the Microsoft Entra Device Registration cloud service that lets an unauthenticated network attacker elevate privileges (CVSS 3.1 base 10.0, temporal 8.7). Microsoft published it on 2026-11-06 and reportedly states the issue is already fully mitigated server-side with no customer action required; no exploitation has been reported.

- **Published:** 2026-11-10T13:51:02Z
- **Last reviewed:** 2026-11-10T13:51:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5650
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5650.png
- **ID:** TL-2026-5650
- **Severity:** CRITICAL (CVSS 10)
- **Category:** CLOUD
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 5
- **CVEs:** CVE-2026-109469

## Description

CVE-2026-109469 was published by Microsoft (secure@microsoft.com CNA) on 2026-11-06 (reserved 2026-10-12, date public 2026-11-05). The record, titled "Entra Device Registration Elevation of Privilege Vulnerability", describes an "Authorization bypass through user-controlled key in Entra Device Registration" that allows an unauthorized attacker to elevate privileges over a network. The weakness is CWE-639. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (base 10.0; exploitability sub-score 3.9, impact sub-score 6.0); OpenCVE shows temporal metrics E:U/RL:O/RC:C, and Penligent reports a temporal score of 8.7. NVD status was Awaiting Analysis at last check, with CPE cpe:2.3:a:microsoft:entra_device_registration:*:*:*:*:*:*:*:* and no version ranges.

The record is tagged as an exclusively hosted service. Microsoft Entra Device Registration is a Microsoft-operated cloud component, so there is no customer-installable patch, KB or build number. A third-party write-up (Penligent, 2026-11-08), which cites MSRC revision 1.0, reports that Microsoft states the vulnerability has already been fully mitigated and that users of the service have no action to take, and that Microsoft rates it not publicly disclosed, not exploited, exploitation less likely. We could not fetch the MSRC advisory directly (the page returned only a title), so this remediation statement is secondary-sourced. OpenCVE's generic advice (install latest update, restrict API access to trusted networks, network segmentation, extensive logging of registration attempts) is AI-generated and is not vendor guidance; its statement that impact would be system-wide on a domain controller is likewise an inference, not a vendor claim.

Microsoft has not published the vulnerable endpoint, the user-controlled key, the request format, the privilege boundary crossed, the object type affected, the affected tenant count or exposure interval, or any CVE-specific log signature or indicator of compromise. The record is not listed in CISA KEV, has no SSVC data, and EPSS is about 0.67% (0.00668). No public PoC, threat actor, malware, or network IOCs are associated with it in any verified source. Because the technical mechanism is undisclosed, the MITRE ATT&CK mappings below are inferential from the vulnerability class (network-reachable cloud identity service, privilege elevation, device registration) rather than observed adversary behavior. The IOC entries are monitoring pointers (Entra Device Registration audit activities, the Device Registration Service audit filter, Graph query tooling and Conditional Access control points named in secondary sources), not confirmed indicators of compromise. Penligent notes the audit activities are useful for reconstructing changes but are not a detector for this CVE. Defenders should treat an empty audit search as inconclusive rather than proof of non-exposure, and should preserve correlation IDs, target object IDs, initiator data, Conditional Access results and sign-in records for any suspicious device object.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1098.005 Device Registration
- T1078.004 Cloud Accounts
- T1556.009 Conditional Access Policies

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-109469 Follow-On - Registered Owner/User Added to Multiple Entra Devices** (`TL-2026-5650-SPL-002`)

Detects an initiator adding registered owners or registered users to 3+ Entra devices within 24 hours (audit activities 'Add registered owner to device' and 'Add registered users to device'). After a Device Registration authorization bypass, attackers could attach identities to device objects to persist (T1098.005, parent T1098) and then sign in as valid cloud accounts (T1078.004). Inferred from the vulnerability class; not a confirmed CVE-specific indicator.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1098.005, T1098, T1078.004
- **Data sources:** azure_ad_audit_logs: index=azure sourcetype=azure:monitor:aad category=AuditLogs, Microsoft Sentinel AuditLogs table, Entra ID audit logs (Device Registration Service)
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

```spl
index=azure sourcetype=azure:monitor:aad category=AuditLogs properties.loggedByService="Device Registration Service" operationName IN ("Add registered owner to device","Add registered users to device") | eval initiator=coalesce('properties.initiatedBy.user.userPrincipalName','properties.initiatedBy.app.displayName',"NO_INITIATOR") | eval owner_upn='properties.targetResources{}.userPrincipalName' | bin _time span=24h | stats count AS assignments values(owner_upn) AS assigned_identities values(operationName) AS ops values(correlationId) AS correlation_ids BY _time initiator | where assignments>=3
```

### Microsoft KQL

```kql
AuditLogs
| where TimeGenerated > ago(24h)
| where LoggedByService == 'Device Registration Service'
| where OperationName in ('Add registered owner to device','Add registered users to device')
| extend Initiator = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName), 'NO_INITIATOR'), InitiatorIp = tostring(InitiatedBy.user.ipAddress)
| summarize Assignments = count(), Operations = make_set(OperationName), CorrelationIds = make_set(CorrelationId, 25) by Initiator, InitiatorIp, bin(TimeGenerated, 24h)
| where Assignments >= 3
```

### Sigma

```yaml
title: Entra Registered Owner or User Added to Device (CVE-2026-109469 Follow-On)
id: 6b0e5a1c-3d52-4f0b-9a7e-5650a0000002
status: experimental
description: Detects assignment of a registered owner or registered user to an Entra device object, a persistence pointer (Device Registration account manipulation) after possible abuse of CVE-2026-109469. Correlate volume and initiator in the SIEM; this rule alone is a low-fidelity hunting signal.
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109469
    - https://attack.mitre.org/techniques/T1098/005/
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.persistence
    - attack.t1098
    - attack.t1098.005
    - attack.defense-evasion
    - attack.t1078.004
    - cve.2026-109469
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        properties.loggedByService: 'Device Registration Service'
        properties.message:
            - 'Add registered owner to device'
            - 'Add registered users to device'
    condition: selection
falsepositives:
    - Help-desk or Intune/Autopilot workflows assigning primary users to devices
    - Employee device replacement and tenant migrations
level: medium
```

**Known false positives:**

- Help-desk staff or Intune/Autopilot assigning primary users to many devices
- Device refresh cycles and merger/tenant-migration projects

**Tuning notes:** Exclude known help-desk and provisioning accounts, and raise or lower the assignments>=3 threshold per tenant baseline. Review matched device objects against Get-MgDevice inventory (trustType, registrationDateTime) and Intune/Autopilot enrollment records. Treat assignments to privileged users, or by initiators with no prior device-management activity, as higher priority.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-109469 Follow-On - New Entra Device Followed by Sign-In From Different IP (Sentinel) (locked: unlock with TL Creds)
- CVE-2026-109469 Follow-On - Bulk Entra Device Enumeration via Microsoft Graph (Sentinel) (locked: unlock with TL Creds)
- CVE-2026-109469 Follow-On - Entra Device Deletion Burst or Initiator-Less Delete (Sentinel) (locked: unlock with TL Creds)
- CVE-2026-109469 Entra Device Registration Bypass Indicators - Sigma Primary (locked: unlock with TL Creds)
- CVE-2026-109469 Risky Successful Sign-In to Device Registration Service - Sigma Primary (locked: unlock with TL Creds)
- CVE-2026-109469 Follow-On - Conditional Access Policy Update or Deletion - Sigma Primary (locked: unlock with TL Creds)
- CVE-2026-109469 Entra Device Registration Service Activity With No Initiator or Mass Object Touch (locked: unlock with TL Creds)
- CVE-2026-109469 Follow-On - Conditional Access Policy Tampering on Register or Join Devices (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [OpenCVE - CVE-2026-109469](https://app.opencve.io/cve/CVE-2026-109469)
- [Microsoft MSRC Update Guide - CVE-2026-109469](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109469)
- [Penligent - CVE-2026-109469 status on November 8, 2026](https://www.penligent.ai/hackinglabs/?p=10369)
- [SecurityOnline CVE Watchtower - CVE-2026-109469](https://securityonline.info/cve-watchtower/cve-2026-109469/)
- [ThreatInt CVE record - CVE-2026-109469](https://cve.threatint.com/CVE/CVE-2026-109469)
- [CVE.org record - CVE-2026-109469](https://www.cve.org/CVERecord?id=CVE-2026-109469)
- [Microsoft Learn - Microsoft Entra audit activities reference](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities)
- [Microsoft Learn - Graph directoryAudit list API](https://learn.microsoft.com/en-us/graph/api/directoryaudit-list)
- [Microsoft Learn - Conditional Access cloud apps and user actions](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5650