Technology
Microsoft: analysis of 383,000 vulnerabilities shows which ones attackers actually exploit
Microsoft’s analysis finds that only about 2,000 of roughly 383,000 disclosed software vulnerabilities, around 0.5%, have been tied to real attacks, and that most of them are takeover-type flaws.
Of the roughly 383,000 software vulnerabilities disclosed from 1999 to September 2026, only about 2,000 (around 0.5%) have been tied to real attacks. The figure comes from an analysis Microsoft published on Monday, November 2, 2026 on its security blog, titled “What exploited vulnerabilities have in common” and signed by the Microsoft Security Research team and Yair Tsarfati and Or Begam.
The researchers find that the vulnerabilities that end up being exploited cluster in “takeover” categories, that is, weaknesses that let someone take control of a system: remote code execution (RCE), authentication bypass and local privilege escalation. Together these account for 78% of the vulnerabilities exploited in real attacks.
What the data show
The analysis compares each category’s share among all published vulnerabilities (CVEs) with its share among those exploited in attacks. Remote code execution on servers rises from 20% to 37%, local privilege escalation from 11% to 18% and client-side remote code execution from 4% to 13%. By contrast, XSS, the injection of malicious code into web pages, falls from 15% to 4%, and denial of service from 16% to 7%.
There is also a difference in where the flaw lies. Of all published vulnerabilities, 23% concern operating systems. Among those exploited in attacks the share reaches 41%. Specifically, of the 2,056 exploited vulnerabilities recorded, 59% concern applications and 41% operating systems. In a separate chart, Microsoft examines 1,239 exploited remote-takeover vulnerabilities and breaks them down by platform.
The authors warn that the official classification of a vulnerability does not always match what an attacker can reliably achieve. That is why, for prioritisation, demonstrated impact and exploitability matter, not only the CVE label.
Time and prioritisation
Time plays a critical role. Microsoft Security Exposure Management data for 2026 show the median time to apply security updates is about two weeks on Windows workstations and more than a month on Windows servers. On Linux servers and macOS applications it exceeds 10 weeks, and on network devices more than a year. Meanwhile VulnCheck has recorded that 29% of 2025 exploitations began within a day of the CVE’s publication.
The US CISA’s Known Exploited Vulnerabilities (KEV) catalogue follows the same trend. The average time from CVE publication to catalogue entry fell from 89 days in 2024 to 57 in 2025, while on data through September 2026 the average is 20 days and the median 3 days.
For organisations, Microsoft recommends prioritising takeover vulnerabilities, because dealing with them interrupts attacks early. The combination of impact and exposure determines the extent of damage, and the most dangerous are servers that use identities with more privileges than they need. Next come denial of service on systems where availability is critical and credential leakage, which, depending on the environment, can prove serious, since credentials feed attack paths towards privileged identities.
The company recommends discovering internet-exposed systems from the attacker’s point of view, prioritising by risk beyond the CVSS score and analysing attack paths, so that they are cut before a breach spreads. It cites its own tools, such as Defender External Attack Surface Management, Defender Vulnerability Management and Security Exposure Management.
