Fixed Vulnerability still getting detected under Exposure Management

JC 40 Reputation points
2026-10-29T22:11:46.59+00:00

Hi,

We have remediated several vulnerabilities and can confirm that the affected applications have been updated. However, the changes are not yet reflected in Microsoft Defender Exposure Management, and the applications still appear in the Defender software inventory with the previous vulnerable versions.

Could you please advise on the following:

  1. How long does it typically take for Exposure Management to reflect the updated software versions? It has been more than 48 hours since the remediation was completed.
  2. Is a device reboot required for Defender to detect and update the software inventory?
  3. Would it be beneficial to perform a Defender antivirus scan or manually sync the device to expedite the update?

Any guidance would be appreciated.

Microsoft Security | Microsoft Defender | Other
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-10-29T22:12:34.5566667+00:00

    Because software inventory normally updates every three to four hours and cannot be force-synchronized, a version that remains stale after 48 hours should be investigated through the affected device’s Software Evidence and sensor health rather than by initiating an antivirus scan.^1^

    Check what Defender is still detecting

    1. In the Microsoft Defender portal, go to Assets > Devices.
    2. Open an affected device.
    3. Select Inventories, then locate the application under Software.
    4. Select the application and review Software Evidence.

    Software Evidence identifies whether Defender detected the old version from the registry, disk, or both.^1^

    • Old file path shown: Verify whether the updater left an old executable, library, installation directory, or side-by-side version on disk.
    • Old registry path shown: Check whether an obsolete uninstall or product-version registration remains after the upgrade.
    • Evidence shows the new version: Open the software page and check whether the displayed value is a normalized version. Defender intentionally normalizes versions for some products, so the portal version can differ from the locally reported version while remaining functionally equivalent.^1^

    Do not remove files or registry entries solely to clear the portal result. First establish whether they belong to the current application or are genuinely obsolete.

    Check endpoint telemetry

    On the affected device page, verify that Sensor health state is Active. An active device is regularly sending telemetry. Inactive, No sensor data, Impaired communications, or Misconfigured can prevent complete or timely reporting.^2^

    For an unhealthy state:

    • Inactive/No sensor data: Confirm the device is powered on, connected, and still onboarded.
    • Impaired communications: Investigate network connectivity, proxy settings, and firewall access to Defender for Endpoint services.
    • Misconfigured: Review onboarding prerequisites, proxy configuration, and sensor configuration.

    The portal’s Device health view can also filter devices by Misconfigured or Inactive status.^3^

    If the portal reports one of those unhealthy states, run Microsoft Defender for Endpoint Client Analyzer on the affected endpoint. It collects the diagnostics needed for sensor, connectivity, and reliability problems on Windows, Linux, and macOS.^4^

    Reboot, antivirus scan, and manual sync

    • Manual sync: Not available for the software inventory. Microsoft documents a three-to-four-hour update interval and states that there is currently no way to force synchronization.^1^
    • Defender Antivirus scan: This is not the mechanism documented for refreshing Vulnerability Management software inventory. Inventory uses Defender for Endpoint detection and vulnerability-assessment signals, so a Quick or Full antivirus scan should not be expected to expedite the update.^5^
    • Reboot: A reboot is not documented as a general inventory-refresh requirement. Reboot only when the application update itself requires one to finish replacing loaded files or completing installation. Afterward, leave the device online so its sensor can submit new telemetry.

    If the evidence and sensor are correct

    If the device is Active, Software Evidence no longer identifies an old component, and the stale result persists:

    1. Open Exposure management > Vulnerability management > Inventories > Software.
    2. Select the affected software.
    3. Use Report inaccuracy from the software flyout.
    4. Include the affected devices, CVEs, locally installed versions, remediation time, Software Evidence details, and screenshots or exports showing the stale portal state.

    The software inventory documentation designates Report inaccuracy for incorrect vulnerability information or assessment results.^1^

    References

    1. Software inventory
    2. Device inventory field reference
    3. Check service health at Microsoft Defender for Endpoint
    4. Troubleshoot sensor health using Microsoft Defender for Endpoint Client Analyzer
    5. What is Microsoft Defender Vulnerability Management
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.