CVE exceptions are now generally available

December 2025

• (Preview) Microsoft Secure Score now includes new recommendations to help organizations proactively prevent common endpoint attack techniques:

1. Disable Remote Registry service on Windows: Prevents remote access to the Windows registry, reducing attack surface and blocking unauthorized configuration changes, privilege escalation, and lateral movement.
2. Disable NTLM authentication for Windows workstations: Helps prevent credential theft and lateral movement attacks by removing support for an outdated and insecure protocol. New Technology LAN Manager (NTLM) can be exploited with techniques like Pass-the-Hash and NTLM relay, allowing attackers to bypass password complexity and compromise domains.

• (GA) CVE exceptions are now generally available, and also support:
• The False positive justification. Learn more
• The status field as part of the response for the GET /api/vulnerabilities request.