XDR Not Recognising Hotpatches

Karl-Foley — Wed, 03 Jun 2026 10:59:40 GMT

We've started deploying WIndows Enterprise Hotpatches to speedup the adoption of patches and reducing the number of reboots required.

Howver, XDR doesn't recognise the Hotpatches and is telling us that the endpoints are still vulnerable. This is a known "limitation" according to support.

What are others doing in this space please?

Re: XDR Not Recognising Hotpatches

susekar — Mon, 10 Aug 2026 18:17:30 GMT

Hello @Karl-Foley ,

Greetings for the day.

The issue is a known limitation in the Cortex XDR Vulnerability Assessment (VA) engine.

Root Cause:
The VA engine primarily evaluates the Windows OS build number and does not fully account for the UBR changes introduced by Windows hotpatching. As a result, it may incorrectly report certain cumulative updates as missing.

Recommended Approach:

Verify that the required hotpatch is installed on the endpoint.
If the CVE is confirmed as a false positive, exclude it from the Vulnerability Assessment dashboard.
Consider enabling the Enhanced Vulnerability Assessment under Settings > Configurations > Vulnerability Assessment. This provides more detailed vulnerability analysis but may not fully resolve the UBR-related issue.
For a permanent fix, coordinate with your Palo Alto Networks Account Team to track the relevant feature enhancement.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

topic Re: XDR Not Recognising Hotpatches in Cortex XDR Discussions

XDR Not Recognising Hotpatches

Re: XDR Not Recognising Hotpatches