use CVE exceptions to exclude specific Common Vulnerabilities and Exposures

October 2025

• (Preview) You can now use CVE exceptions to exclude specific Common Vulnerabilities and Exposures (CVEs) from analysis in your environment. CVE exceptions allow you to control what type of data is relevant to your organization and to selectively exclude certain data from your remediation efforts. For more information, see Exceptions in Microsoft Defender Vulnerability Management and Create, view, and manage exceptions.
• (Preview) Microsoft Secure Score now includes new recommendations to help organizations proactively prevent common endpoint attack techniques.

1. Block web shell creation on servers – reduces the risk of web-based persistence and remote code execution attacks.
2. Block use of copied or impersonated system tools – helps prevent attacker misuse of legitimate administrative utilities for lateral movement or privilege escalation.
3. Block rebooting a machine in Safe Mode – helps defend against attackers who attempt to disable endpoint protection or persist through reboots.