Detect endpoints exposed to CVE-2025-21760
Identify Defender-managed devices currently reporting exposure to CVE-2025-21760.
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2025-21760"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel descSecOps Signal does not execute queries against private telemetry. Paste the query into Microsoft Sentinel Log Analytics or Defender advanced hunting and review it first. Passed structure and schema checks; tenant execution is not verified.
Query anatomy
Static check against a reviewed column list| Column | Table | In reviewed schema list |
|---|---|---|
| DeviceId | DeviceTvmSoftwareVulnerabilities | Listed |
| DeviceName | DeviceTvmSoftwareVulnerabilities | Listed |
| OSPlatform | DeviceTvmSoftwareVulnerabilities | Listed |
| OSVersion | DeviceTvmSoftwareVulnerabilities | Listed |
| SoftwareVendor | DeviceTvmSoftwareVulnerabilities | Listed |
| SoftwareName | DeviceTvmSoftwareVulnerabilities | Listed |
| SoftwareVersion | DeviceTvmSoftwareVulnerabilities | Listed |
| CveId | DeviceTvmSoftwareVulnerabilities | Listed |
| VulnerabilitySeverityLevel | DeviceTvmSoftwareVulnerabilities | Listed |
| RecommendedSecurityUpdate | DeviceTvmSoftwareVulnerabilities | Listed |
| RecommendedSecurityUpdateId | DeviceTvmSoftwareVulnerabilities | Listed |
“Listed” only means the column name appears in the reviewed list for that table. It does not confirm the column exists in your tenant's current schema, and per-column purposes are not recorded.
Hunting notes
Identify Defender-managed devices currently reporting exposure to CVE-2025-21760.
Use during vulnerability triage, exposure review, and remediation validation.
Schema checked only. This query has not been executed against a Sentinel or Defender tenant.