Exposed Devices & Exploitable Vulnerabilities

The question it answers: Which vulnerabilities affect the most devices, and which of them have public exploits?

The patching backlog in business terms: which CVEs affect the most devices, and which of them have public exploit code. Patch those first - they are what ransomware operators use.

Note

ThreatHunting.Read.All reads all Defender XDR telemetry - consent it deliberately.

At a glance

Where in the app	Tenant › Defender & Security Operations › Exploitable Vulnerabilities
Workload	Security
Kind	Findings list · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed).
Licence	Defender for Endpoint P2 or Defender Vulnerability Management.
Report id (API and MCP)	tenant.secops.vulnerabilities

Columns

Column	Key	Type
Severity	Severity	Status
Software	Category	Text
CVE	Subject	Link
Check	Setting	Text
Severity / CVSS / exploit	Value	Text
Finding	Finding	Text
Versions / devices	Detail	Text
Published	When	Date
Exposed devices	Number	Number

A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).

What it needs

Licence: Defender for Endpoint P2 or Defender Vulnerability Management.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
ThreatHunting.Read.All	Microsoft Graph	Run hunting queries and read shared saved hunting queries

Data sources it reads

• POST /v1.0/security/runHuntingQuery (DeviceTvmSoftwareVulnerabilities, DeviceTvmSoftwareVulnerabilitiesKB)

Through the API and MCP

GET /ir-api/v1/reports/tenant.secops.vulnerabilities?size=100

An AI assistant reads it with the MCP tool get_report and the id tenant.secops.vulnerabilities. The client needs the Read grant for Security. See Using the API.