Entra Device Registration Elevation of Privilege Vulnerability
Hello! I just noticed this recently vulnerability reported by Microsoft (CVE-2026-109469) on November 5, 2026. According to the description: “Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.” This is not good. Any elevation of privilege may indicate the possibility of lateral movement. Why? Well all registered devices are trusted. Meaning it has a Primary Refresh Token (PRT) and it behaves like a logged on device. So, if an attacker is capable of registering a fake device or hijacking one, it’s like a stolen credential. What this tells me is that attackers were likely able to register device linked to users that did not register the same device. This may even involve hybrid-joined device. Regardless, this appears to be the abuse. ...