> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/security/defender/defender-cve-exceptions.md).

# CVE Management

Vulnerabilities found by Microsoft Defender are rolled up here one row per CVE, with the devices and tenants each one affects, so you can work a vulnerability across your customer base instead of tenant by tenant. Against each CVE you can record an exception with a reason and an expiry, marking it as handled so it stops competing for attention.

## Action Buttons

<details>

<summary>Sync</summary>

Queues a refresh of the CVE data behind the table and tracks the job's progress on the page.

</details>

## Table Details

| Column                       | Description                                                                                                |
| ---------------------------- | ---------------------------------------------------------------------------------------------------------- |
| Cve Id                       | The CVE identifier. Each row is one CVE.                                                                   |
| Tenant Count                 | How many tenants the CVE was found in.                                                                     |
| Devices                      | How many affected devices were counted across those tenants.                                               |
| Vulnerability Severity Level | Microsoft's severity rating for the vulnerability.                                                         |
| Exploitability Level         | Microsoft's assessment of how exploitable the vulnerability is.                                            |
| Has Exception                | Whether an exception has been recorded against this CVE. Drives whether **Remove Exception** is available. |
| Affected Devices             | The devices the CVE was found on. Expand the cell to see the full list.                                    |
| Affected Tenants             | The tenants the CVE was found in. Expand the cell to see the full list.                                    |

{% hint style="warning" %}
An exception is recorded in CIPP only. Nothing is written back to Microsoft Defender, so the vulnerability still appears in the Defender portal exactly as before. Exceptions change what CIPP shows you, not what Microsoft reports.
{% endhint %}

## Table Actions

<table><thead><tr><th>Action</th><th>Description</th><th data-type="checkbox">Bulk Action Available</th></tr></thead><tbody><tr><td>Add Exception</td><td>Records an exception against the selected CVE. Prompts for an <strong>Exception Type</strong> of <code>Risk Accepted</code>, <code>Compensating Control</code>, <code>False Positive</code> or <code>Planned Remediation</code>; an <strong>Apply Exception To</strong> scope of <code>Current Tenant Only</code>, <code>All Affected Tenants</code> or <code>All Tenants (Global)</code>; a <strong>Justification</strong>, which is required and is kept alongside the exception with your name and the date; and an optional <strong>Exception Expiry Date</strong>. Recording an exception where one already exists for the same scope replaces it.</td><td>true</td></tr><tr><td>Remove Exception</td><td>Removes a recorded exception from the selected CVE, prompting for a <strong>Remove Exception From</strong> scope of <code>Current Tenant Only</code>, <code>All Affected Tenants</code> or <code>All Tenants (Global)</code>. Greyed out on a CVE that has no exception recorded against it.</td><td>true</td></tr></tbody></table>

{% hint style="info" %}
`Current Tenant Only` needs a specific tenant selected. It cannot be used while you are on All Tenants, since there is no single tenant for the exception to apply to.
{% endhint %}

{% hint style="warning" %}
The `All Affected Tenants` scope currently fails when recording an exception and reports an error instead of writing one. Until this is resolved, use `All Tenants (Global)` to cover every tenant, or record the exception one tenant at a time with `Current Tenant Only`. Removing an exception with `All Affected Tenants` is unaffected.
{% endhint %}

***

## Feature Requests / Ideas

We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.cipp.app/user-documentation/security/defender/defender-cve-exceptions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.