Created by Claude - please verify

Vulnerabilities - Defender Vulnerability Management data through advanced hunting (top 500 CVEs by exploit and exposure).

Required Microsoft Graph permissions

ThreatHunting.Read.All — application permission, granted to the app registration with admin consent.

Licence: Defender for Endpoint P2 or Defender Vulnerability Management.

Endpoint: POST /v1.0/security/runHuntingQuery (DeviceTvmSoftwareVulnerabilities, DeviceTvmSoftwareVulnerabilitiesKB)

ThreatHunting.Read.All reads all Defender XDR telemetry - consent it deliberately.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Exposed Devices & Exploitable Vulnerabilities

The patching backlog in business terms: which CVEs affect the most devices, and which of them have public exploit code. Patch those first - they are what ransomware operators use.