Microsoft’s analysis of approximately 383,000 disclosed vulnerabilities shows that attackers overwhelmingly favor weaknesses enabling system takeover rather than exploiting vulnerabilities indiscriminately.
The research identifies 2,056 CVEs linked to real-world exploitation, roughly 0.5% of the population, highlighting why vulnerability management must prioritize demonstrated attacker utility over disclosure volume or severity scores alone.
Covering vulnerabilities published from 1999 through September 2026, Microsoft’s catalog-based assessment classifies vulnerabilities by their most consequential direct impact and affected platforms.
Its central finding is that takeover vulnerabilities, including remote code execution, authentication bypass, and local privilege escalation, account for 78% of exploited vulnerabilities.
These weaknesses can compromise network-exposed services without user interaction, making them valuable entry points.
Local privilege escalation increases from 11% of disclosures to 18% of exploited vulnerabilities, helping attackers convert limited footholds into privileged access.
Client-side remote code execution shows an even sharper proportional increase, rising from 4% of disclosed CVEs to 13% of exploited vulnerabilities.
Unlike server-side exploitation, these attacks require victims to open or execute malicious content. Conversely, cross-site scripting declines from 15% to 4%, while denial-of-service vulnerabilities fall from 16% to 7%.
Microsoft Researchers said that, Server-side remote code execution represents 20% of published vulnerabilities but 37% of exploited CVEs.
383,000 Vulnerabilities Analyzed
Operating-system vulnerabilities also attract disproportionate attention. Although OS and system code account for 23% of the analyzed population, they represent 41% of exploited vulnerabilities.
Classified vulnerabilities by the platforms they affect, including Windows, Linux/Unix, mobile, network appliances, IoT/OT, virtualization hosts, and developer packages.
Application code constitutes the remaining 77% of disclosures. Microsoft cautions that classifications alone are insufficient: an apparent code-execution vulnerability may produce only crashes under practical exploitation conditions.
Microsoft Security Exposure Management telemetry illustrates the operational imbalance.
Median remediation takes approximately two weeks on Windows workstations, more than a month on Windows Servers, and over ten weeks on Linux servers access and macOS applications.
Network appliances show the longest delay, exceeding one year, leaving critical infrastructure exposed well beyond typical emergency-response cycles.
Independent research reinforces the urgency. VulnCheck’s State of Exploitation 2026 identified 884 vulnerabilities with first-time exploitation evidence during 2025.
Of these, 28.96% were exploited on or before their CVE publication date, demonstrating that disclosure may arrive after attacks have already begun rather than providing defenders an advance warning.
Microsoft also warns that AI-assisted vulnerability discovery and exploit development could further compress response windows.
However, defenders must distinguish exploitation dates from catalog inclusion dates: publication-to-listing intervals measure reporting and curation processes, not necessarily when attackers first weaponized a weakness.
Microsoft argues that remediation decisions should combine impact with exposure. A compromised server becomes substantially more dangerous when its service accounts, cloud identities, permissions, or trusted connections provide access to additional systems.
Consequently, the same vulnerability can create different business risks depending on the affected asset’s position.
Microsoft Defender External Attack Surface Management supports this approach by discovering internet-facing infrastructure, including previously unknown assets and third-party dependencies.
Its inventory gives defenders an external view of reachable systems. Microsoft’s analysis further emphasizes vulnerability prioritization and attack-path assessment to identify routes from exposed workloads to critical resources.
Where patching is delayed, removing unnecessary exposure and restricting excessive privileges can help limit subsequent compromise.
Availability-critical services and exposed credentials still warrant urgent attention when their business context makes consequences severe.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
