XDR Not Recognising Hotpatches

[Karl-Foley]

We've started deploying WIndows Enterprise Hotpatches to speedup the adoption of patches and reducing the number of reboots required.

Howver, XDR doesn't recognise the Hotpatches and is telling us that the endpoints are still vulnerable. This is a known "limitation" according to support.

What are others doing in this space please?

[susekar]

Hello @Karl-Foley ,

Greetings for the day.

The issue is a known limitation in the Cortex XDR Vulnerability Assessment (VA) engine.

Root Cause:
The VA engine primarily evaluates the Windows OS build number and does not fully account for the UBR changes introduced by Windows hotpatching. As a result, it may incorrectly report certain cumulative updates as missing.

Recommended Approach:

• Verify that the required hotpatch is installed on the endpoint.
• If the CVE is confirmed as a false positive, exclude it from the Vulnerability Assessment dashboard.
• Consider enabling the Enhanced Vulnerability Assessment under Settings > Configurations > Vulnerability Assessment. This provides more detailed vulnerability analysis but may not fully resolve the UBR-related issue.
• For a permanent fix, coordinate with your Palo Alto Networks Account Team to track the relevant feature enhancement.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar