Azure VM with high severity vulnerabilities allows lateral movement to

Question

Azure VM with high severity vulnerabilities allows lateral movement to

Bogdan Eremia 25

Hi,

I have multiple virtual machines and I gave access to those machines to other resources like storage account, Azure KeY vault but in every morning I get "Azure VM with high severity vulnerabilities allows lateral movement to..." with different Riks Level.

I also raised a support case 2504020040004758 managed by [email protected] or [email protected] but my issue still persists. I need to help to understand why I got this alerts and why I do not get support?

Durga Reshma Malthi 7,510 Reputation points Microsoft External Staff Moderator

2025-07-24T07:00:07.9833333+00:00

Hi Bogdan Eremia

The message Azure VM with high severity vulnerabilities allows lateral movement to usually comes from Microsoft Defender for Cloud. It indicates that:

One or more Azure VMs have known vulnerabilities like missing patches, misconfigured services, open ports, outdated software, etc.

You can try the below option:

Go to Microsoft Defender for Cloud > Recommendations > Security Recommendations. Search for the VM name and check what vulnerabilities are flagged. Install missing updates/patches, disable unnecessary services, or update outdated software as recommended.

Regarding the support case, you can check the status under Help + support.

Hope this helps!

Please Let me know if you have any queries.
Bogdan Eremia 25 Reputation points

2025-07-24T07:03:23.25+00:00

I believe you do not read what I wrote just paste the problem in Copilot or other internal tool and paste here. Please next time to do not paste anymore something that I can do also is waste of time for you and for me reading the same thing couple of times.
Raja Pothuraju 27,510 Reputation points Microsoft External Staff Moderator

2025-07-28T12:41:40.1633333+00:00

Hello Bogdan Eremia,

I have reviewed the support ticket and understand that the alerts appearing on your end are false positives that need to be removed from the backend. I see that the support engineer handling the ticket has already engaged our engineering team regarding this issue. It appears that it may take some additional time to complete the removal process. I will check internally with the engineer for an update and keep you informed accordingly.