Defender Vulnerability Management intentionally normalizes versions for some software to improve cross-device correlation and assessment. Consequently, its displayed string can differ from the installed string without representing a different functional version. Microsoft does not describe every difference as an error. Microsoft Learn.
\nThe device’s Software Evidence section identifies detection evidence in the registry, on disk or both. The inventory overview refreshes every three to four hours and cannot be manually forced to synchronize. Report inaccuracy provides a route for an actual incorrect software detail or device count. Microsoft Learn.
\nReview software version records in Microsoft Defender Vulnerability Management inventory. This brief concerns reconciliation of an observed version discrepancy, not a claim that every software product is assessed or that all differing strings are equivalent.
\nDSE recommends preserving the locally observed version, displayed version, product identity and observation time together. Inspect the device-level evidence before proposing a reinstall or reporting a false vulnerability result. Where normalization does not explain the discrepancy, collect the specific evidence needed for an inaccuracy report. Do not invent a conversion formula from one documented product example and apply it to unrelated software.
\nCompare a known installation with its registry or disk evidence and the portal record after the documented refresh interval. Confirm that the same product and device are being compared. Record whether normalization, delayed inventory or an unresolved discrepancy best fits the evidence, without presenting an inference as a confirmed correction. Preserve both original strings in the final review.
\n