Microsoft Patches Critical Authorization Bypass in Entra Device Registration Cloud Service

Microsoft has addressed CVE-2026-109469, a critical (CVSS 10.0) authorization bypass vulnerability in its Entra Device Registration cloud service. The flaw, which could allow an unauthorized attacker to elevate privileges over a network, was fixed by Microsoft on its own infrastructure, requiring no customer action.