Why is Defender still flagging CVE-2023-36010 after updates?

First, compare the exact affected product and version range in the alert with the installed Defender versions on each device. If the range really excludes versions earlier than the one shown in the alert, and the devices are running a later platform, this may be a vulnerability-inventory or version-mapping problem rather than evidence that the old component is still installed.

I wouldn't dismiss it based on that alone. Check the device's current inventory and alert details, confirm the update has applied and the device has reported in, then raise it with Microsoft support if the discrepancy persists. Include the device versions and the CVE's stated affected range.

A small signature-version gap by itself doesn't establish that the CVE is still exploitable, especially when the engine and platform match the current published versions. But don't assume the signature update will clear a vulnerability assessment either. AV intelligence and vulnerability inventory are related, but they aren't necessarily the same detection path.

Check whether the alert has refreshed since the devices updated, and whether all affected devices have the same installed version. If it remains after inventory refresh, gather the alert evidence and ask Microsoft to confirm whether the detection mapping is correct.

I'd treat this as unresolved until you can account for the finding, but I wouldn't rush into extra configuration changes just because the alert names a CVE. Verify the actual Defender product version on the affected machines, not only the central dashboard, and check for any older or side-by-side installation that the inventory might be detecting.

If those checks are clean and the reported version is outside the listed vulnerable range, document the mismatch and escalate it. That gives you a much stronger basis for calling it a likely reporting issue than simply ignoring the alert.