Azure Kubernetes Service: Stale vulnerability assessment — Recommendation not updated since 11/2025

TITLE: Azure Kubernetes Service: Stale Vulnerability Assessment — Not Updated Since November 2025

DETAILS: Title: Defender for Cloud: preview assessment 5409cb02 ("Vulnerable Azure Kubernetes Service should be updated…") frozen since Nov 2025 and holds "Remediate vulnerabilities" at 0/6

Problem

On all three of our subscriptions, the Defender for Cloud preview assessment 5409cb02-6884-4de3-870d-c17b98bbe04f ("Vulnerable Azure Kubernetes Service should be updated to resolve vulnerability findings") has not updated since November 2025. The records are not "not evaluated": they show Unhealthy, but they describe a cluster state that no longer exists.

Re-checked 2026-11-11 via Azure Resource Graph.

Evidence that the records are stale:

• The record for kube-system/kube-proxy reports image tag v1.33.3-hotfix.20250922 with CVE-2025-47914 and CVE-2025-58181. The cluster now runs kube-proxy:v1.36.4-2, after at least three minor-version upgrades since November 2025.
• Two subscriptions still report containers in a namespace (pod-identity: aad-pod-identity-mic, nmi) that we deleted in August 2026.
• Other Defender components assess the same container entities normally:

Kubernetes data plane hardening recommendations (e.g. 047d1366, 324ad474) running-container vulnerability assessment (SoftwareUpdate findings since 2026-08-28) the GA successor "Upgrade Azure Kubernetes Service Version" (2dfd0218-23eb-7e68-73c3-3057bde27b59): 14 / 14 / 11 Unhealthy, last updated 2026-11-03 / 2026-11-10

Only 5409cb02 is frozen.

Impact on Secure Score

5409cb02 is the only unhealthy assessment in the secure score control Remediate vulnerabilities (05daab2e-f074-4601-ac10-aadf5c9c50f6, max score 6). That holds the control at 0.00 / 6.00 on every subscription, about 20.7 percentage points of secure score each.

• 5409cb02 is in the control's assessmentDefinitions.
• Its working successor 2dfd0218 is not. Fixing everything the successor reports therefore can't recover the score.
• The docs say preview recommendations "don't affect Secure Score". Here a preview assessment that no longer evaluates zeroes a GA control through the parent-resource roll-up.

Environment

• 3 subscriptions, each with one AKS cluster (2× West Europe, 1× Switzerland North)
• Kubernetes 1.36.4 / 1.36.4 / 1.36.5, node image AKSUbuntu-2404gen2containerd-202610.x (Ubuntu 24.04, Linux)
• All clusters Running / Succeeded; all node pools Succeeded / Running (checked 2026-11-11)
• Defender for Containers: Standard on all three. Extensions AgentlessVmScanning, AgentlessDiscoveryForKubernetes, ContainerRegistriesVulnerabilityAssessments and ContainerSensor are enabled and identical on all three.
• Azure Policy add-on enabled on all clusters

What we have already tried

1. Enabled Agentless machine scanning, the prerequisite named in the 2025-11-19 release note "General availability of agentless vulnerability assessment for AKS runtime containers". It has been on since 2026-08-20 / 2026-08-24.
2. Node VA appeared within about 30 minutes of that change. Running-container VA findings followed from 2026-08-28.
3. 5409cb02 did not change on any subscription. We have waited more than two months since enabling.
4. Checked the records via Azure Resource Graph and the Assessments REST API, and checked control membership via secureScoreControlDefinitions.
5. Confirmed cluster and node pool health.

The freeze dates (2025-11-20 to 2025-11-25) come right after the 2025-11-19 GA release note. The 2026-06-01 release note then introduced "Upgrade Azure Kubernetes Service Version" (2dfd0218, GA 2026-06-30) as the replacement of "the previous non-actionable recommendation". 5409cb02 matches that description: same scope (AKS-managed system pods), no remediation path.

Questions

1. Was 5409cb02 retired or superseded at the November 2025 GA transition? If yes, can its stale records be purged, or can it be removed from the Remediate vulnerabilities control (and 2dfd0218 added if it is the intended replacement)?
2. If it is not retired: why did it stop evaluating in November 2025, and how do we get it running again?
3. Is it supported to delete these stale built-in assessment records ourselves via the Assessments REST API (DELETE …/providers/Microsoft.Security/assessments/5409cb02-…), or would they be recreated?

Reproduction

Azure Resource Graph:

securityresources
| where type == 'microsoft.security/assessments'
| extend k = tostring(split(id, '/assessments/')[1])
| where k startswith '5409cb02' or k startswith '2dfd0218'
| summarize n = count(), newest = max(todatetime(properties.status.statusChangeDate))
    by k, subscriptionId, status = tostring(properties.status.code)

Control membership:

GET https://management.azure.com/providers/Microsoft.Security/secureScoreControlDefinitions?api-version=2020-01-01
→ 05daab2e-f074-4601-ac10-aadf5c9c50f6 → properties.assessmentDefinitions

Control score:

GET https://management.azure.com/subscriptions/{subId}/providers/Microsoft.Security/secureScores/ascScore/secureScoreControls?api-version=2020-01-01

Case ID: fb1b37f8-f6e5f434-74be60bb-91b3-4f84-84a0-f81a758c3b32