Get discovered vulnerabilities

Applies to:

Want to experience Microsoft Defender for Endpoint? Sign up for a free trial.

Want to experience Microsoft Defender Vulnerability Management? Learn more about how you can sign up to the Microsoft Defender Vulnerability Management public preview trial.


If you are a US Government customer, please use the URIs listed in Microsoft Defender for Endpoint for US Government customers.


For better performance, you can use server closer to your geo location:


API description

Retrieves a collection of discovered vulnerabilities related to a given device ID.


  1. Rate limitations for this API are 50 calls per minute and 1500 calls per hour.


One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Use Microsoft Defender for Endpoint APIs

Permission type Permission Permission display name
Application Vulnerability.Read.All 'Read Threat and Vulnerability Management vulnerability information'
Delegated (work or school account) Vulnerability.Read 'Read Threat and Vulnerability Management vulnerability information'

HTTP request

GET /api/machines/{machineId}/vulnerabilities

Request headers

Name Type Description
Authorization String Bearer {token}. Required.

Request body



If successful, this method returns 200 OK with the discovered vulnerability information in the body.



Here is an example of the request.



Here is an example of the response.

    "@odata.context": "$metadata#Collection(Analytics.Contracts.PublicAPI.PublicVulnerabilityDto)",
    "value": [
            "id": "CVE-2019-1348",
            "name": "CVE-2019-1348",
            "description": "Git could allow a remote attacker to bypass security restrictions, caused by a flaw in the --export-marks option of git fast-import. By persuading a victim to import specially-crafted content, an attacker could exploit this vulnerability to overwrite arbitrary paths.",
            "severity": "Medium",
            "cvssV3": 4.3,
            "exposedMachines": 1,
            "publishedOn": "2019-12-13T00:00:00Z",
            "updatedOn": "2019-12-13T00:00:00Z",
            "publicExploit": false,
            "exploitVerified": false,
            "exploitInKit": false,
            "exploitTypes": [],
            "exploitUris": []

See also