SOCRadar reports CVE-2026-109469, CVSS 10 Entra device registration flaw

What happened

According to SOCRadar, a vulnerability tracked as CVE-2026-109469 is a CVSS 10 flaw in Entra device registration. SOCRadar’s post is dated 2026-11-10, per the headline listing for SOCRadar: CVE-2026-109469: CVSS 10 Entra Device Registration Flaw.

That is all the available source text supports. The scraped page contained only site navigation and menu content, and none of the article body. The following are therefore not confirmed:

• the affected products and versions
• the nature of the flaw and how it could be triggered
• whether a fix or mitigation exists
• whether anyone has exploited it
• whether the vendor has published its own advisory

The CVSS 10 score comes only from the title of SOCRadar’s post. We have not independently verified it, and no official source (vendor advisory or NVD record) was available to us. The severity field in this advisory is set to info for that reason: it reflects the lack of confirmed detail, not a judgment that the flaw is minor. If the score is confirmed by an official record, this advisory will be revised.

Am I affected?

Not confirmed. SOCRadar’s title points to the Entra device registration feature, but the source gives no affected versions, configurations or conditions. If your organization uses Entra device registration, treat yourself as potentially in scope until the official record or the vendor says otherwise.

What to do now

1. Read the NVD entry for CVE-2026-109469 and the vendor’s own security advisory for confirmed scope, severity and fix status.
2. Identify whether your tenant uses Entra device registration, and who owns that configuration.
3. Apply any vendor-published patch or mitigation once one is confirmed. The sources name no fixed version, so none is stated here.
4. Revisit this advisory when an official source is available. It will be updated with confirmed details.

Sources

• SOCRadar: CVE-2026-109469: CVSS 10 Entra Device Registration Flaw