Microsoft Silverlight SEoL is the Nessus finding (plugin 58134) raised when Silverlight is still installed on a host. Microsoft ended Silverlight support on October 12, 2021, so there is no fixed version to upgrade to. The fix is to uninstall it (silently with msiexec /x at scale), clear leftover folders, and retire any application that still needs it.

What the scanner is actually detecting

Scanner	Finding	ID	Severity
Nessus (Tenable)	Microsoft Silverlight SEoL	Plugin 58134	Critical, CVSS v3 9.8

Plugin 58134 is a local check in the Nessus “Misc.” family. It does not test for any particular bug. It fires whenever the knowledge base item installed_sw/Microsoft Silverlight exists, and two detection plugins feed that item:

42399 Microsoft Silverlight Detection (Windows): an informational plugin that enumerates the registry over SMB, so it needs a credentialed scan.
58091 Microsoft Silverlight Installed (Mac OS X): the equivalent local check for macOS.

Because the product is discontinued, every Silverlight version counts as end of life. Updating to the last Silverlight 5 build does not clear the finding. Tenable’s solution text simply says the product has been discontinued and refers you to the vendor, which in practice means removal.

How serious is it in practice?

Silverlight is a browser plug-in, and its history of attacks came through web content. Two Silverlight remote code execution flaws, CVE-2013-0074 and CVE-2016-0034, are in the CISA Known Exploited Vulnerabilities catalog. Both were added on May 25, 2022, and CISA’s required action for each is that the end-of-life product should be disconnected if still in use. No Silverlight flaw found after October 2021 will ever be patched.

Exposure depends on how the host is used. Microsoft’s end-of-support announcement lists Internet Explorer 10 and 11 as the only supported browsers and states that Chrome, Firefox and Mac browsers are no longer supported. A workstation where users still open internal sites in Internet Explorer is genuine attack surface. A server where Silverlight was installed years ago and nobody browses is lower practical risk, but it still fails every audit and will never receive a fix. The 9.8 score reflects that policy judgement, not a confirmed exploit path on your host.

Confirm it on the host

Use an elevated, 64-bit PowerShell session. A 32-bit process is redirected to the WOW6432Node registry view and to Program Files (x86), so it can miss the native install.

List Silverlight uninstall entries in both registry views. For Windows Installer products, the subkey name (PSChildName) is the product code:

$keys = 'HKLM:SOFTWAREMicrosoftWindowsCurrentVersionUninstall*',
        'HKLM:SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstall*'
Get-ItemProperty -Path $keys -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -like 'Microsoft Silverlight*' } |
    Select-Object DisplayName, DisplayVersion, PSChildName, UninstallString

Microsoft’s own cleanup article for broken Silverlight installs uses the product code {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}, so expect to see that value. Then check for the install folders and the Silverlight configuration key:

Test-Path "$env:ProgramFilesMicrosoft Silverlight"
Test-Path "${env:ProgramFiles(x86)}Microsoft Silverlight"
Test-Path 'HKLM:SOFTWAREMicrosoftSilverlight'

To check a list of servers at once, wrap the same commands in Invoke-Command -ComputerName (Get-Content .hosts.txt) -ScriptBlock { … }. Before removing anything, find out whether it is in use: look for a running out-of-browser launcher with Get-Process sllauncher -ErrorAction SilentlyContinue, and ask application owners about internal sites that still prompt for Silverlight.

How to fix it

1. Uninstall Silverlight on a single host

Remove “Microsoft Silverlight” from Apps and Features (or appwiz.cpl), or run the silent uninstall from an elevated prompt:

msiexec /x {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} /qn /norestart /l*v "%windir%Tempsilverlight-uninstall.log"

Windows Installer returns 0 for success and 3010 for success with a restart required. 1605 means no product with that code is installed (use the product code you found in the registry), and 1618 means another installation is already running, so retry later.

2. Script for fleet removal

This script reads whatever Silverlight product codes the host actually has, uninstalls each one, and removes the leftover program folders only when every uninstall succeeded. Run it as SYSTEM or an administrator in 64-bit PowerShell:

$keys = 'HKLM:SOFTWAREMicrosoftWindowsCurrentVersionUninstall*',
        'HKLM:SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstall*'
$apps = Get-ItemProperty -Path $keys -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -like 'Microsoft Silverlight*' -and
                   $_.PSChildName -match '^{[0-9A-Fa-f-]{36}}$' }
$failed = $false
foreach ($app in $apps) {
    $log = "$env:windirTempsilverlight-$($app.PSChildName).log"
    $p = Start-Process -FilePath msiexec.exe -Wait -PassThru `
        -ArgumentList "/x $($app.PSChildName) /qn /norestart /l*v `"$log`""
    '{0} {1}: exit code {2}' -f $app.DisplayName, $app.DisplayVersion, $p.ExitCode
    if ($p.ExitCode -notin 0, 3010, 1605) { $failed = $true }
}
if ($failed) { exit 1 }
foreach ($dir in "$env:ProgramFilesMicrosoft Silverlight",
                 "${env:ProgramFiles(x86)}Microsoft Silverlight") {
    if (Test-Path $dir) { Remove-Item -Path $dir -Recurse -Force -ErrorAction SilentlyContinue }
}
exit 0

Pilot it on a small group first, then widen the rollout in waves, the same pattern we describe for uninstalling a Windows update across hundreds of endpoints.

3. Remove Silverlight with SCCM (Configuration Manager)

Configuration Manager can uninstall an application even if it did not install it. Create an application with a Windows Installer deployment type, set the Uninstall program on the Programs tab to msiexec /x {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} /qn /norestart, and use the same product code as the detection method. Then deploy it to a device collection and choose Uninstall as the action on the Deployment Settings page (the purpose becomes Required automatically). Microsoft’s documentation warns that you must first delete any install, simulated or task sequence deployments of the same application, because an install deployment always wins over an uninstall deployment. You can also deploy the fleet script above as a script-based deployment type if your inventory shows more than one product code.

4. Remove Silverlight with Intune

If Silverlight was never deployed through Intune, push the fleet script as a platform script: Devices > Scripts and remediations > Platform scripts > Add > Windows 10 and later. Set Run this script using the logged on credentials to No so it runs in system context, and set Run script in 64-bit PowerShell host to Yes. Both defaults are the opposite, and the default 32-bit host would read the redirected registry and folder paths. Intune runs a platform script once and, if it fails, retries it at the next three check-ins. If Silverlight was deployed as an Intune app, change that app’s assignment to Uninstall instead.

5. Group Policy startup script

For domain-joined machines without SCCM or Intune, save the script to a share that computer accounts can read and add it under Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown) > Startup, on the PowerShell Scripts tab. Startup scripts run as Local System at the next restart. If Silverlight was originally assigned through Group Policy Software Installation, remove the package from that GPO as well, or it can be reinstalled.

6. Broken installs that will not uninstall

When msiexec fails and the entry stays in Apps and Features, follow Microsoft’s archived article Clean a corrupted Silverlight installation. Its manual procedure deletes HKLMSOFTWAREMicrosoftSilverlight, the Windows Installer product registration, the AgControl COM registrations, the Uninstall{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} key and both Microsoft Silverlight folders. Export each key with reg export before deleting it, and skip the article’s final step, which reinstalls Silverlight.

7. Applications that still need Silverlight

There is no supported way to keep Silverlight. Ask the vendor for a current release or replace the internal application. Until then, confine it to as few dedicated hosts as possible, keep those hosts away from general web browsing, and track them as a documented exception.

Verify the fix and rescan

Re-run the registry and folder checks. All of them should return nothing or False.
Read the msiexec log for any host that returned something other than 0 or 3010.
Run a credentialed Nessus scan. Plugin 58134 relies on registry enumeration by plugin 42399, so check that the scan authenticated (Nessus Scan Information, plugin 19506, reports whether credentialed checks ran) before treating a missing finding as closure.
Confirm that informational plugin 42399 is also gone. If 42399 still reports Silverlight, something remains on the host.

What can break and how to roll back

Internal web applications built on Silverlight show an install prompt instead of loading.
Out-of-browser Silverlight applications installed in user profiles stop launching, because the runtime they depend on is gone.
Automatic reinstallation by an existing SCCM install deployment, a GPO software assignment or a golden image brings the finding back after the next scan.

Windows itself does not depend on Silverlight. To roll back, reinstall it from the package in your own software library; do not rely on finding a download from Microsoft now that the product is retired. Before you start, confirm your library still holds the installer. Any host you roll back becomes a documented exception with an owner and a review date.

Common false positive reasons

The detection reads what is on the host, so true false positives are rare. What looks like one is usually one of these:

Partial uninstall. The program folder or registry keys survived a failed or interrupted uninstall. Use the cleanup procedure above.
Only one registry view cleaned. A 32-bit tool or agent looked only at WOW6432Node and Program Files (x86).
Reinstalled by deployment tooling. An install deployment, GPO assignment or image put it back.
Stale results. The report came from a scan that ran before the change.
macOS hosts. 58134 also fires through the macOS detection plugin 58091. That is a correct result: the Silverlight plug-in is still present on the Mac.

FAQ

Will Windows Update remove Silverlight?

No. Microsoft said it would not take specific action to terminate Silverlight applications after end of support. You have to remove it yourself.

Is there a newer Silverlight version that clears plugin 58134?

No. Silverlight 5 was the last version, and its support ended on October 12, 2021. Every installed version is flagged.

Is it safe to uninstall Silverlight from servers?

Windows does not need it. The only thing to check is whether an application or console on that server still uses it.

Why is it Critical if nobody uses it?

Tenable scores this plugin at 9.8 because no future Silverlight flaw will be fixed. Your real exposure depends on whether a browser on the host can still load the plug-in.

Tracking this finding across many hosts

Silverlight tends to appear on dozens of hosts at once, and proving each one closed is most of the work. SITEY, a self-hosted vulnerability management platform, imports Nessus results from uploaded .nessus exports, can have its AI draft a host-specific removal script that its Windows agents deploy only after human approval, and supports per-finding retest for Nessus findings such as plugin 58134 to confirm the removal held.

Discovery and visibility

Scanning and collection

The AI layer

Action and closure

Team and governance

Reporting

Microsoft Silverlight SEoL: How to Remove Silverlight (Nessus 58134)