Microsoft Security Research published a short, numbers-heavy analysis on 2 November 2026 of which vulnerabilities attackers actually use. The headline figure: from 1999 through September 2026 roughly 383,000 vulnerabilities were disclosed, and only about 2,000 CVEs (around 0.5%) have been linked to real-world exploitation. The exploited set is 2,056 CVEs in their data. Fewer than 1 in 200 published CVEs ever gets used in an attack.
This post goes through what the report says, what I think follows from it, and where the numbers need care. Everything quoted below comes from the Microsoft Security blog post, which I read in full.
The exploited set is not a sample of the whole
The authors classified each CVE by impact class and platform, then compared the full population against the exploited subset. The shift is large:
| Impact class | Share of all published CVEs | Share of exploited CVEs |
|---|---|---|
| Server-side RCE | 20% | 37% |
| Local privilege escalation | 11% | 18% |
| Client-side RCE | 4% | 13% |
| Cross-site scripting | 15% | 4% |
| Denial of service | 16% | 7% |
Operating-system code goes from 23% of all CVEs to 41% of exploited ones. Windows is the most affected platform in the exploited set.
The report groups remote code execution, authentication bypass and local privilege escalation as "takeover" classes and says they account for 78% of exploited vulnerabilities. Its reasoning is plain: these give an attacker a foothold and control, while a crash or a limited script execution offers less to build on.
Patching runs slower than exploitation
Two clocks are compared. On the defender side, Microsoft's exposure data from 2026 shows the median vulnerability patched in about two weeks on Windows workstations, more than a month on Windows Servers, 10+ weeks on Linux servers and macOS applications, and beyond a year on network appliances.
On the attacker side, the report cites VulnCheck (29% of exploits in 2025 were launched within one day of CVE publication) and CISA data on the time from CVE publication to the KEV catalog: a mean of 89 days in 2024, 57 days in 2025, and 20 days for 2026 through September, with a median of 3 days.
The two sets of numbers come from different sources and measure different things. Patch times describe Microsoft's customer telemetry. KEV timing describes when CISA added a CVE to its list, which can lag the first exploitation. So the comparison shows a direction, not a precise gap. The report also says AI-assisted exploit development is "a significant factor" in shortening timelines, attributing this to industry research without giving a measurement. I would treat that as a claim, not a finding.
What the numbers do and do not say
A few cautions before using this to set priorities.
"Exploited" means known exploited. The 2,056 CVEs are the ones with evidence of exploitation in Microsoft's catalog. A vulnerability not on the list may simply not have been observed. The 0.5% is a floor on what is used, not a ceiling.
A label is not a capability. The authors note that some vulnerabilities described as RCE end up as denial of service in practice. Impact class comes from the advisory text. Whether a flaw is reliably exploitable is a separate question the CVE entry often does not answer.
Base rates are not your environment. The 78% takeover figure describes attackers in aggregate. Your own exposure depends on which of your systems are reachable and which identities they hold.
The practical part: impact times exposure
The report's prioritization argument is that two things set a vulnerability's value to an attacker: what exploitation gives them, and how exposed and connected the asset is. A server with a service account holding broad permissions has a larger blast radius than a workstation with the same bug.
For a small team without a vulnerability-management product, a workable reading is:
- Start from what is reachable from the internet. An inventory of exposed services comes before any CVE list.
- Within that, rank by class. Server-side RCE, authentication bypass and privilege escalation first. XSS and crash bugs later, unless the asset is one where downtime is the real damage. The report explicitly names availability-critical systems and credential disclosure as the "next in line" slice.
- Check KEV before CVSS. A CVE on the CISA catalog has evidence of exploitation. A CVSS 9.8 without that evidence is a different kind of risk.
- Shrink the slow tail. If network appliances take a year to patch, the realistic control is reducing their exposure, not waiting for the patch cycle.
- Look at the identity behind the system. Trim over-broad service accounts. That limits what a successful exploit can reach, and it works even when patching cannot happen.
The report ends with product recommendations for Microsoft Defender tools. That section is vendor material and I have not evaluated it; the data section stands on its own and is the useful part.
Takeaway
Most vulnerabilities are never exploited, and the ones that are cluster in a few classes that give an attacker control. The patching windows in the data are longer than the exploitation windows. Spend effort where impact and exposure overlap, and use known-exploitation evidence to order the work.
Source: Microsoft Security Research (Yair Tsarfaty, Or Begam), "What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks", 2 November 2026. This is a summary and commentary, not security or legal advice.
