Microsoft Defender Vulnerability Management Now Reports CVEs Lacking Fixes -- Redmondmag.com

Microsoft Defender Vulnerability Management Now Reports CVEs Lacking Fixes

By Kurt Mackie
06/27/2022

Microsoft is previewing the ability for organizations to see when software lacks fixes for common vulnerability and exposures (CVEs), as described in a Monday announcement.

CVEs are reported software vulnerabilities. The CVE-reporting capability in Microsoft Defender Vulnerability Management is currently available at the preview stage. The Microsoft Defender Vulnerability Management product itself is also at the preview stage.

Microsoft Defender Vulnerability Management was introduced last month as a new "standalone" product and add-on option for E5 customers and Microsoft Defender for Endpoint Plan 2 subscribers. Subscribers to the Microsoft Defender Vulnerability Management service get a bunch of asset and inventory tools, assessment tools, plus prioritization and remediation solutions.

Such tools are likely useful for a lot of organizations, but they come at an extra cost. It costs $3 per user per month for the standalone product and $2 per user per month for the E5 and Microsoft Defender for Endpoint Plan 2 add-ons. The product's add-on status for top-level E5 licensing is perhaps a new signal that Microsoft won't always include new E5 subscription capabilities without charging separately for them.

The Microsoft Defender Vulnerability Management Portal shows the new CVE-reporting capability via a "Weaknesses" page (also called a "tab" by Microsoft). It has an "Update Availability" column that displays CVE availability information, which is shown for both devices and software. This sort of information wasn't previously shown in the portal, the announcement explained:

Before the introduction of this feature, CVEs missing security updates were not shown in the Defender Vulnerability Management portal. Once a customer enables this feature in public preview, these CVEs will be reported in the Inventory and Weaknesses pages.

If there's no CVE fix, the Weaknesses tab will call out that information. Updates that are available, but just for particular software versions, also are shown. Given these capabilities, Microsoft adjusted the "Recommendations" tab in the portal to only show devices and software when security updates are available.

The new CVE-reporting capabilities were also added to Microsoft's "export software vulnerabilities assessment API." It'll surface information about software lacking CVE fixes as well.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Multi-Tenant Organization Hooks Released for Microsoft 365

Microsoft Entra ID's new multi-tenant organization capabilities have reached general availability (GA).
Real-World Ransomware Recovery

Here's how I was (mostly) successful in recovering a family PC infected with malware.
Microsoft Launches Small AI Models Family Phi-3

Recognizing that bigger isn't always better, Microsoft has released its smallest open AI models to date, Phi-3.
Microsoft and OpenAI Continue Global AI Expansions

Microsoft and OpenAI each continued their global expansion this month, with the announcements of new infrastructure investments and service rollouts in new regions, like Asia and the Middle East.
Cisco Warns of Brute Force Attacks Targeting VPNs and Firewalls

Cisco has revealed that a global increase in brute force attacks targeting Virtual Private Networks (VPNs) and other devices is currently taking place.