Question

Your organization uses Microsoft Defender for Endpoint with Defender Vulnerability Management enabled. A new critical CVE affecting a widely deployed browser is announced. Your security manager asks you to quickly determine how many onboarded devices in your environment are affected by this specific CVE and whether it is being actively exploited in the wild. Which Defender Vulnerability Management area should you use to get this information most directly?

Accepted Answer

Open the Weaknesses page in Defender Vulnerability Management, search for the CVE ID, and review the exposed devices count and threat insights

Answer

Run a Live Response session on a sample device and manually query the installed browser version

Answer

Review the Secure Score improvement actions and filter by the Defender for Endpoint category

Answer

Create an advanced hunting query against the DeviceProcessEvents table to look for the browser process