Not every CVE should be handled the same way, and choosing the wrong exception type can remove more risk visibility than intended.
A security recommendation can include many CVEs. If only one CVE is out of scope, excluding the full recommendation can hide vulnerabilities that still matter in your environment. CVE exceptions help you make a narrower decision: exclude one specific CVE for a defined scope and duration, while keeping the rest of the recommendation active.
Use this guide to make precise, scoped decisions with CVE exceptions, understand how they differ from recommendation exceptions, and know what changes in your risk visibility after an exception takes effect.
Important: CVE exceptions are not just a way to hide a CVE from a page. For the selected scope, they change how the CVE is analyzed, surfaced in inventory, reflected in scores, and connected to related threat analytics and alerts.
Use CVE exceptions only when the decision is intentional, documented, time-bound, and scoped to the right device groups.
This post covers CVE exceptions specifically. CVE exceptions exclude a single CVE for a defined duration and scope. They are different from recommendation exceptions, which exclude an entire security recommendation and all CVEs associated with it.
When to use a CVE exception
Use a CVE exception when your decision applies to a specific CVE, not to the entire recommendation.
Common scenarios include:
| Scenario | When to use it |
|---|---|
| No vendor patch available | The CVE exists, but the software vendor has not released a fix yet. You want to temporarily exclude the CVE while monitoring for vendor remediation. |
| False positive | Your investigation confirms that the CVE does not apply to the affected devices or configuration. |
| Risk accepted | Your organization reviewed the CVE and accepted the residual risk for the selected scope. |
| Planned remediation | A patch exists, but you need time to test and deploy it through your change-management process. |
| Alternate mitigation | An internal tool, third-party control, or operational process already addresses this specific vulnerability. |
Do not use a CVE exception just because remediation is difficult. Use it only when there is a documented reason to exclude that specific CVE for a specific scope.
How CVE exceptions differ from recommendation exceptions
Choosing between a CVE exception and a recommendation exception matters. A CVE exception removes one vulnerability from analysis. A recommendation exception suppresses a broader remediation item, which may include many CVEs.
| CVE exception | Recommendation exception | |
|---|---|---|
| What it excludes | A single CVE, for example CVE-2026-28387 | An entire recommendation and all CVEs associated with it |
| Where you create it | From the CVE details page by selecting Exception options | From the related security recommendation |
| Scope of impact | Only the specified CVE is excluded for the selected scope | The full recommendation becomes inactive for the selected scope |
| Unique justifications | Includes CVE-specific justifications such as CVE with no patch and False positive | Does not include CVE-specific justifications |
| Result | The CVE status changes to Exception globally or Partially active by device group | The recommendation state changes to full or partial exception |
Choose a CVE exception when one specific vulnerability should be excluded, but the rest of the recommendation should remain active. For example, if a recommendation covers 15 CVEs and only one is a false positive in your environment, exclude that CVE, not the entire recommendation.
Choose a recommendation exception only when the entire recommendation should be inactive for the selected scope, for example when none of its CVEs apply to your environment or when the recommendation category is intentionally handled by another tool.
Before you create a CVE exception
Use CVE exceptions only when the decision is intentional, documented, time-bound, and scoped to the right device groups.
Before creating one, make sure you understand the impact:
- The CVE is excluded from vulnerability analysis for the selected scope.
- The CVE may no longer appear in inventory lists for devices covered by the exception.
- Related threat analytics and alert context for the excluded CVE may be suppressed.
- Exposure score and Microsoft Secure Score for Devices may change.
- The exception expires after the selected duration. Durations cannot be extended. You must create a new exception if you need continued coverage.
How to create a CVE exception
Prerequisites
Before you create a CVE exception:
- You need the exceptions handling permission in your RBAC role. You can verify this under Settings > Endpoints > Roles.
- CVE exceptions are currently supported only in the Microsoft Defender portal. They are not available through public API.
Step 1: Open the CVE details page
In the Microsoft Defender portal, open the CVE you want to exclude.
Depending on your portal experience, you can find CVEs from:
- Exposure management > Recommendations > Vulnerabilities
- Endpoints > Vulnerability management > Weaknesses
On the CVE details page, review the vulnerability details, severity, affected software, exposed devices, and related recommendation.
From the CVE details page, review the vulnerability context, then select Exception options to create a CVE exception.
Step 2: Select Exception options
At the bottom of the CVE details page, select Exception options.
This opens the Create exception pane for the selected CVE.
Step 3: Choose the exception scope
Choose whether the exception should apply globally or only to specific device groups.
| Scope | Use when |
|---|---|
| Global exception | The CVE should be excluded across all current and future device groups. |
| Exception per device group | The CVE should be excluded only for specific device groups. |
Use global exceptions carefully. A global exception affects all current and future device groups. If the CVE is irrelevant only for a subset of assets, use specific device groups instead.
Choose the exception scope. Use device group scope when the CVE is irrelevant only for part of your environment.
Step 4: Select justification and duration
Select the justification that best explains why the CVE should be excluded.
Available justifications include:
- Third party control
- Alternate mitigation
- Risk accepted
- Planned remediation
- CVE with no patch
- False positive
Then provide additional justification context. This context helps future reviewers understand why the exception was created.
Finally, set the exception duration. CVE exceptions are time-bound. When the exception expires, the CVE returns to active inventory and scoring for the relevant scope if it is still detected and applicable.
Step 5: Submit the exception
Select Submit.
It can take up to one hour for the exception to take effect. During this period, the CVE may still appear in reports and dashboards.
What happens after you create a CVE exception
Once the exception takes effect:
| Area | What changes |
|---|---|
| CVE status | The CVE status changes to Exception for a global exception or Partially active for a device group exception. |
| Inventory | The CVE no longer appears in inventory lists for the selected scope. |
| Exposed devices | For a global exception, no exposed devices are shown for that CVE during the exception period. For a device group exception, only devices outside the selected groups remain exposed. |
| Scores | Exposure score and Microsoft Secure Score for Devices may change. For CVE exceptions, the score impact depends on scope, not justification. |
| Threat context | Related threat analytics and alert context for the excluded CVE may be suppressed. |
| Recommendations | Other CVEs in the related recommendation remain active unless they are also excluded. |
View and manage CVE exceptions
You can view active exceptions from the Remediation page.
Go to Remediation > Exceptions.
From there, you can:
- View CVE and recommendation exceptions.
- Filter and review exceptions in effect.
- Export exception details.
- Open an exception to review status, justification, creator, expiration date, and remaining time.
- Cancel an exception.
The Exceptions tab shows active exceptions and their details, including justification, type, expiry date, and remaining time.
Cancel a CVE exception
You can cancel a CVE exception at any time.
You can cancel:
- The full exception across all covered device groups.
- The exception for a specific device group, if the exception was scoped by device group.
You can only cancel exceptions for device groups where you have permissions.
After an exception is canceled, the CVE returns to active inventory and scoring for the relevant scope if it is still detected and applicable.
Renewing a CVE exception
CVE exception durations cannot be extended.
When an exception expires, the CVE returns to active inventory and scoring for the relevant scope if it is still detected and applicable. If you still need the exception, create a new one with the required duration and scope.
Tips for using CVE exceptions effectively
| Tip | Why it matters |
|---|---|
| Scope narrowly | Use device group exceptions when possible. This preserves visibility where the CVE may still be relevant. |
| Document the decision | The selected justification is recorded, but internal context is still important for audit and review. |
| Use realistic durations | Align the exception duration with your remediation, mitigation, or review timeline. |
| Review exceptions regularly | A “CVE with no patch” exception may no longer be valid after the vendor releases a fix. |
| Avoid broad suppression | Use CVE exceptions for precision. Use recommendation exceptions only when the full recommendation should be inactive. |
When not to use a CVE exception
Do not use a CVE exception when:
- You want to suppress an entire recommendation. Use a recommendation exception instead.
- The CVE is still under investigation and you have not confirmed the rationale.
- You need a permanent suppression. CVE exceptions are time-bound.
- You want to remove risk from reporting without an approved risk decision.
- The issue applies to multiple CVEs in the recommendation and should be handled at the recommendation level.
Common questions
Can I create a CVE exception from the Recommendations page?
No. CVE exceptions are created from the CVE details page. Recommendation exceptions are created from the related security recommendation.
Does a CVE exception affect all recommendations that include that CVE?
Yes. When you exclude a CVE, it is excluded from analysis wherever it appears for the selected scope, including any recommendations that reference it.
Can I create a CVE exception through API?
Not currently. CVE exceptions are supported only through the Microsoft Defender portal.
What happens when a CVE exception expires?
The CVE returns to active inventory and scoring for the relevant scope if it is still detected and applicable. You need to create a new exception if you want to continue excluding it.
Does the justification affect my exposure score?
For CVE exceptions, the justification does not affect the score impact. The score impact depends on the exception scope.
Should I use a CVE exception or a recommendation exception?
Use a CVE exception when one specific CVE should be excluded. Use a recommendation exception only when the entire recommendation and all associated CVEs should be excluded.
Will a device group exception apply to future device groups?
No. A device group exception applies only to the selected device groups at the time you create it. If you need coverage for all current and future device groups, use a global exception.
Microsoft