Devices should not be publicly exposed with remotely exploitable, highly likely to be exploited, high or critical severity CVE's.

Why This Matters

Publicly exposed devices with known critical vulnerabilities are a primary entry point for attackers. If a device has a CVE rated high or critical and is remotely exploitable, it can be compromised without user interaction, leading to data breaches or lateral movement within your tenant. Admins must identify and patch these exposures to reduce the attack surface.

What Aether365 Checks

This check scans your Microsoft 365 environment for any devices publicly accessible on the internet that are associated with remotely exploitable, high likelihood, high severity, or critical CVEs. It appears in the Aether365 dashboard under microsoft-365 checks.

How to Fix

Remediation requires a coordinated approach between security and device management teams. Follow these steps: