Hello! I just noticed this recently vulnerability reported by Microsoft (CVE-2026-109469) on November 5, 2026. According to the description:

“Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.”

This is not good. Any elevation of privilege may indicate the possibility of lateral movement. Why? Well all registered devices are trusted. Meaning it has a Primary Refresh Token (PRT) and it behaves like a logged on device. So, if an attacker is capable of registering a fake device or hijacking one, it’s like a stolen credential. What this tells me is that attackers were likely able to register device linked to users that did not register the same device. This may even involve hybrid-joined device. Regardless, this appears to be the abuse.

Sadly, Microsoft has not said much other than its vendor report. However, a score of 10 - Critical is quite serious!

After trying to figure out vector string, this is what I learned:

This Entra ID device registration exploitation is quite serious. The cloud flaw meant that anyone on the Internet could have performed this vulnerability against any tenant without any credentials or help from the victim (such as phishing).

It appears this is an internal finding and no known POCs or exploits are reported. The vulnerability was very bad, and the fix is already in place.

But, it’s important to look back at your logs for anything strange. Since the average Entra ID P1/P2 customer only has 30 days of Entra ID sign-in logs (And sadly, just 7-days for free customers), you do not have much time to look back. These are the things to look out for:

  1. Unrecognized or unfamiliar devices: In Entra Admin Center, go to Devices → All devices and sort by registration date. Look for unfamiliar names, devices registered to the wrong person, a burst of new devices in a short window, or devices marked compliant or joined that you didn’t set up.
  2. Can you explain the device changes? Go to Audit logs and filter Category to Device. Look for “Add device” without any clear user behind it or from an unfamiliar IP. Also, if you see for “Add registered owner to device” on a device that already existed, it may indicate that someone was trying to take over a device.
  3. Unusual sign-ins for device registration: If you check out your sign-in logs, and filter Resource to Device Registration Service, review both interactive and non-interactive tabs for any unusual sign-in behavior such as strange IPs, unfamiliar countries, etc.

If you see any strange devices, wack them! Don’t forget to revoke the user’s sessions too.

Time to move on and finish my coffee.