Live status of all services Advisory

The Microsoft Defender portal isn't displaying affected products for some Common Vulnerabilities and Exposures (CVEs)

Microsoft Defender XDR DZ1519662

Microsoft Defender Vulnerability Management Admins cannot see certain CVE affected products for PHP2SHELL CVEs.

Status
Service degradation
Feature
Threat and Vulnerability Management
Region
Not specified (all regions)
Started
Oct 21, 2026, 23:00 CEST
Duration
2 h 56 min
Last update
Oct 22, 2026, 01:22 CEST
Next update
Oct 21, 2026, 04:00 CEST

Current status

We're completing our final validations within our internal environment, and we remain on track to remediate the issue by Thursday, October 22, 2026, at 1:00 AM UTC.

More info

The API listed below is not working when directly called and not displaying affected products as expected in the UI.
/api/vulnerabilities/{vulnerabilityId}/affectedProducts/

Scope of impact

Admins attempting to view affected products within the UI or using the affected API are impacted.

Root cause

A limitation on the values returned by the API leads to the affected API not returning any results.

Timeline

Every update Microsoft posted for this issue, newest first.

  1. Oct 22, 2026, 01:22 CEST

    We're completing our final validations within our internal environment, and we remain on track to remediate the issue by Thursday, October 22, 2026, at 1:00 AM UTC.

  2. Oct 22, 2026, 00:18 CEST

    We've determined that limitations on the values returned by the affected API resulted in this impact. We've developed a solution which we are rolling out to our internal environment, after which we will test to validate it fully remediates the issue before rolling out throughout the impacted environment. We expect we will be able to complete the validation and further rollout to resolve impact by Thursday, October 22, 2026, at 1:00 AM UTC.

When Microsoft 365 goes down

The live overview shows the current state of every Microsoft 365 service, refreshed every minute from Microsoft Graph.

Live status of all services Subscribe to incidents in LEXOJ

To see whether your own tenant is affected, check Service health in the Microsoft 365 admin center. Only a backup outside Microsoft protects against data loss, and only a tested break-glass account against locked-out admins. We set up both in fixed-scope sprints.

Source: Microsoft Graph, Service Communications API. This is the view of a Swiss Microsoft 365 tenant: services not licensed there are missing, and individual issues may affect your tenant differently. Microsoft names the region only in the issue text. The Switzerland view shows issues for Switzerland, for Europe in general and those without a region, but not issues that only name other countries such as Germany or the UK. This page is not provided by Microsoft.