Vulnerability reports and update holds

When the PowerShell tool finds an update for an app that is already in Intune, it compares both the installed and the new version with IntuneBrew's vulnerability data (CVEs from the NVD and the CISA Known Exploited Vulnerabilities list, refreshed daily). Requires version 1.1.0 running from a clone of the repository, which contains the CVE data folder.

Reading the report

Each known vulnerability is placed in one of four groups:

Vulnerabilities that affect neither version are hidden; add -ShowAllCves to list them. High, critical and actively exploited (KEV) indeterminate entries are listed individually as "unable to confirm exposure"; lower ones are only counted. If an app has no data, the report says so. That never means the app is safe.

Holding back updates

Updates are never held unless you choose a level:

IntuneBrew -UpdateAll -SecurityHoldLevel High -ConfigFile ./certificate.json -NonInteractive

-SecurityHoldLevel accepts None (default), Medium, High or Critical. An update is held when it introduces a vulnerability at or above that level, or introduces any actively exploited (KEV) vulnerability.

• Vulnerabilities that already affect the installed version never hold an update, because skipping the update would not remove them.
• Indeterminate entries never hold an update.
• Held apps are listed by name and skipped; the other apps continue. The run ends with exit code 2.
• -IgnoreSecurityHold deploys held updates anyway for one run.