Severity mapping issue: Azure Defender/REST API returning "Unknown" severity for VM vulnerabilities

Question

Severity mapping issue: Azure Defender/REST API returning "Unknown" severity for VM vulnerabilities

Vlad Vantaroo 50

Hi Azure Support Team,

We noticed a data discrepancy between the Azure Portal UI and the programmatic outputs (Azure Cloud Shell CLI and REST API) regarding vulnerability severities.

Affected Resource: VM abc

Observed Behavior: The Azure Portal UI correctly displays 74 vulnerabilities with mixed severity levels (Critical, High, Medium, Low). However, queries via Cloud Shell / REST API now return all of these same CVEs with a severity status of "Unknown".

Timeline: The API was returning the correct severity values as of last Friday. The issue started occurring yesterday without any configuration changes on our end.

Impact: This directly impacts our internal security services and automation, as we rely on the API outputs to ingest and track vulnerabilities.

Questions for the team:

Is this a known issue or an intended behavior change in the API response schema?

Is there an active re-evaluation process for these CVE records, and what is the expected ETA for resolution?

Is this issue isolated to our subscription/tenant or a broader service-side anomaly in Defender for Cloud?

Looking forward to your assistance.

Query in cloud shell:

az graph query -q '
securityresources
| where type =~ "microsoft.security/assessments" and id contains "abc"
| where tostring(properties.metadata.recommendationCategory) =~ "SoftwareUpdate"
| mv-expand cve = parse_json(tostring(properties.additionalData.CvesDetails))
| project cveId = tostring(cve.CveId),
          severity = tostring(cve.Severity),
          cvss = cve.Cvss,
          keys = bag_keys(cve)
| take 100'

CVEs by severity in the UI: Screenshot 2026-08-17 at 5.14.42 p.m.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello @Vlad Vantaroo

Based on what you've shown, this does not look like an intentional severity-schema change.

The key point is that you're querying properties.additionalData.CvesDetails[].Severity from Microsoft.Security/assessments. The same CVEs still have Critical/High/Medium/Low classifications in the Defender for Cloud portal, while the programmatic data changed to Unknown without any configuration change. Since it was returning valid severity values until recently, that strongly suggests a backend data-enrichment/synchronization issue rather than a problem with your Resource Graph query.

I would first confirm the raw assessment payload rather than relying only on the expanded query:

securityresources
| where type =~ "microsoft.security/assessments"
| where id contains "jc-vuln-server"
| where tostring(properties.metadata.recommendationCategory) =~ "SoftwareUpdate"
| project id,
          displayName=tostring(properties.displayName),
          status=tostring(properties.status.code),
          additionalData=properties.additionalData

Then inspect CvesDetails directly. If Severity is already Unknown in additionalData, the issue is upstream of your KQL processing.

Also, don't map Unknown to Informational, Low, or another severity in your automation. Microsoft APIs use defined severity classifications where applicable; substituting a value locally could cause vulnerabilities to be incorrectly prioritized while the backend data is inconsistent. For example, the Defender for Cloud Alerts API explicitly defines its alert severity enumeration as Informational, Low, Medium, and High.

Given that:

the portal still shows populated CVE severities,
the exact CVEs return Unknown programmatically,
the API was returning the expected values previously, and
there were no customer-side configuration changes,

I would treat this as a probable Defender for Cloud service-side data inconsistency and open a Microsoft support request. Include the subscription ID, VM resource ID, affected assessment ID(s), several example CVE IDs, timestamps showing when valid severity was last observed, and the raw Resource Graph output.

Microsoft support would need backend telemetry to confirm whether this is a broader service incident, a re-evaluation/enrichment process, or something isolated to the tenant. I couldn't find a Microsoft-published notice confirming an intentional change that would cause these CVE severity values to return Unknown universally.

Sharing this reference with you: Microsoft Defender for Cloud Alerts REST API

Please "Accept the Answer" if this information helped you. This will help us and others in the community.