> Currently, Defender Vulnerability Management doesn't distinguish between 32-bit and 64-bit system architectures when correlating vulnerabilities (CVEs) to devices. This limitation can lead to false positives, especially in cases where a CVE applies only to one architecture type. For example, on a Windows Server 2016 machine, PHP was incorrectly flagged with `CVE-2024-11236`, which affects only 32-bit systems. Since architecture isn't currently factored into the correlation process, the CVE was incorrectly associated with a 64-bit server. This is a known issue, and a solution is on the roadmap.
0 commit comments