defender for endpoint reports vulnerable openssl versions in azure monitor agent and azure disk encryption extension

Question

hi, defender for endpoint is reporting that the azure monitor windows agent (version 1.39.0.0) and the azure disk encryption extension (version 2.5.0.6) are using vulnerable openssl versions (3.5.1.0 in ama and 3.2.4.0 in ade), which are affected by cve‑2025‑9230, cve‑2025‑9231, and cve‑2025‑9232. can microsoft share any update on when these extensions will receive patched openssl versions, and whether there are recommended mitigations until then?

Answer 1

Microsoft has added support for OpenSSL vulnerabilities, including CVE-2025-9230, CVE-2025-9231, and CVE-2025-9232, in the Microsoft Defender Vulnerability Management. However, specific patch release dates for the Azure Monitor Agent and Azure Disk Encryption Extension have not been provided in the context. It is advisable to monitor official Microsoft channels for updates regarding these vulnerabilities and any potential mitigations that may be recommended until patches are available.

---

References:

• Vulnerability support in Microsoft Defender Vulnerability Management