Microsoft has published a maximum-severity authorization bypass in Entra Device Registration, the service a Windows endpoint calls to join or register with a tenant. It scores 10.0, and there is no customer patch: the fix went into Microsoft's own cloud.
What happened
The flaw is CVE-2026-109469, an authorization bypass through a user-controlled key, classified CWE-639. The registration path accepted a key supplied by the caller without proving it belonged to the identity making the request, so an attacker could present a key of their own and be treated as a trusted device.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C, with high impact on confidentiality, integrity and availability. Network reachable, no account required, no user interaction, scope change: that combination is what pushes the score to 10.0.
Microsoft's record says the issue was neither publicly disclosed nor exploited before the service-side fix. Entra Device Registration is a hosted service, so no tenant update exists, and Microsoft rates exploitation as less likely.
Who is affected
Every tenant that registers, joins or hybrid-joins Windows devices to Entra ID, which covers most Microsoft 365 estates, Intune-managed fleets included.
- Tenants whose Conditional Access policies trust device state as compliant, hybrid joined or Entra joined
- Estates where ordinary users can join a device without administrator approval
- Any tenant that cannot produce an accurate list of registered devices on request
What to do now
There is nothing to install. The work is verification, and it is worth doing this week.
- In the Entra admin center, open Devices then All devices and sort by registration date. Flag every entry you cannot tie to a named user or a known deployment.
- Review the Entra audit log for Device category events in the first week of November: registrations, ownership changes and updates.
- Under Device settings, restrict who may join devices to Entra ID to a named group instead of all users.
- Re-run device-state Conditional Access policies in report-only mode and confirm unknown devices still fail closed.
What this means for South African businesses
The window on this flaw has closed, but the audit it forces is the one most SMEs never run, and device trust is what Conditional Access leans on across Microsoft 365. A tenant where anyone can join a device has an inventory nobody can verify, and that gap outlives any single CVE. My judgement: the exposure from this bug was small, but the number of local tenants that cannot answer which devices are registered to them is not.
Source: Microsoft Security Update Guide for CVE-2026-109469.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.