Since Sept 8, 2026, MSRC has published machine-readable CSAF VEX documents for every Microsoft CVE, extending the Azure Linux pilot from Oct 2025. Feed your scanner from msrc.microsoft.com/csaf/vex/ to cut false positives. It doesn't add any updates you have to deploy.