Entra Device Registration Elevation of Privilege Vulnerability

Tue, 10 Nov 2026 08:12:35 -0500

Hello! I just noticed this recently vulnerability reported by Microsoft (CVE-2026-109469) on November 5, 2026. According to the description:

“Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.”

This is not good. Any elevation of privilege may indicate the possibility of lateral movement. Why? Well all registered devices are trusted. Meaning it has a Primary Refresh Token (PRT) and it behaves like a logged on device. So, if an attacker is capable of registering a fake device or hijacking one, it’s like a stolen credential. What this tells me is that attackers were likely able to register device linked to users that did not register the same device. This may even involve hybrid-joined device. Regardless, this appears to be the abuse.

EntraID on Think Red

Entra Device Registration Elevation of Privilege Vulnerability