Cloud service CVEs fixed by the vendor

Cloud providers now publish CVEs for flaws they fixed in their own services. There is usually no patch for you to apply, but a critical score still matters for your risk register, your audit trail and your questions to the vendor. Each entry is copied from the vendor’s advisory, with the link.

Microsoft · Entra Device Registration · released 2026-11-06

CVE-2026-109469: Entra Device Registration Elevation of Privilege Vulnerability

Authorization bypass through a user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.

Severity: Critical (Elevation of Privilege)
CVSS 3.1: 10.0 base / 8.7 temporal, scored by Microsoft
Weakness: CWE-639: Authorization Bypass Through User-Controlled Key
Publicly disclosed: No
Exploited: No
Vendor assessment: Exploitation Less Likely

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

Customer action: None. Microsoft says the vulnerability has already been fully mitigated and the CVE exists for transparency.

Credit: Thomas Knudson with Microsoft

Microsoft Security Update Guide: CVE-2026-109469 (read 2026-11-08)

What to do with one of these

Record it in your risk register as a vendor-fixed finding, with the date and the advisory link.
Check your Entra and identity logs around the release window for anything unusual, since the advisory does not say when the flaw was introduced.
Ask your vendor contact for their disclosure timeline if you have regulatory or customer obligations.

Tools: SSVC calculator, EPSS lookup, KEV checker, risk register.