Microsoft Defender Vulnerability Management: Private preview for selected developer package vulnerability coverage

Microsoft Defender Vulnerability Management is privately previewing expanded vulnerability coverage for selected Node.js, Python, and Java packages on Windows devices. It integrates with existing workflows, APIs, and exports, with rollout planned from September to December 2026. Organizations should prepare for increased data volume and validate integrations before enabling. What and Why: Microsoft Defender Vulnerability Management is expanding vulnerability coverage to selected Node.js, Python, and Java packages on supported Microsoft Defender for Endpoint-managed Windows devices. During this private preview, participating customers can identify supported vulnerable packages, affected devices, and detected versions through existing vulnerability investigation and recommendation workflows. Package data may also become available through supported API, export, and Advanced Hunting experiences as those preview paths are enabled. The expanded coverage can increase the number of records returned through assessment APIs and complete-file exports. For JSON assessment exports, customers can use supported server-side filters to limit the returned population. Complete-file exports include the full enabled population, so customers can filter the downloaded files by ProductCategory or use the Microsoft-provided legacy component support list to preserve their previous processing scope where needed. This preview provides curated coverage rather than a complete package inventory. Coverage varies by package, platform, collector, and product experience. It does not provide SBOM, dependency graphs, reachability analysis, package ownership, or complete ecosystem coverage. Participants will receive enablement guidance, known limitations, test scenarios, and a dedicated feedback channel. Rollout Schedule: General Availability (Worldwide): We will begin rolling out on late November 2026 and expect to complete by late December 2026. Public Preview (Worldwide): We will begin rolling out on late October 2026 and expect to complete by late November 2026. Targeted Release (Worldwide): We will begin rolling out on late September 2026 and expect to complete by late October 2026. Impact on Your Organization: This feature expands vulnerability management coverage in Microsoft Security Exposure Management (MSEM) to include CVE exposure for a curated set of Node.js, Python, and Java packages on supported Windows devices onboarded to Microsoft Defender for Endpoint. These package findings will appear within existing experiences for software components, vulnerabilities, affected devices, and security recommendations, helping security […]

The post Microsoft Defender Vulnerability Management: Private preview for selected developer package vulnerability coverage appeared first on M365 Admin.