Microsoft Analysis Finds Exploitation Concentrated in High-Impact Vulnerabilities
Summary
Microsoft analyzes 2,056 CVEs exploited in the wild through September 2026, finding exploitation concentrated in takeover vulnerabilities and outpacing patching. It recommends prioritizing high-impact flaws on exposed, critical assets.
Key points
- Microsoft’s catalog covers about 383,000 disclosed CVEs through September 2026; 2,056 were linked to real-world exploitation.
- Remote code execution, authentication bypass, and local privilege escalation account for 78% of exploited vulnerabilities, according to the analysis.
- Server-side RCE represents 37% of exploited CVEs, compared with 20% of all published CVEs; XSS and denial-of-service vulnerabilities are less represented among exploited CVEs.
- OS vulnerabilities make up 41% of exploited CVEs, versus 23% of the overall population.
- Median patching takes more than a month for Windows servers, 10+ weeks for Linux servers and MacOS applications, and over a year for network appliances.
- The article reports that 29% of exploits in 2025 launched within one day of CVE publication; the mean time to CISA KEV listing fell to 20 days in 2026 through September.
- Microsoft recommends prioritizing vulnerabilities by both impact and asset exposure, including the privileged identities and critical resources reachable from affected systems.
Article Details
- Publisher
- Microsoft Security
- Report Period
- CVEs published through September 2026; supporting patch and exploitation data spans 2025–September 2026.
- Scope
- Analysis of disclosed and exploited-in-the-wild CVEs by impact class and affected platform, with vulnerability patching and exploit-timing data.
- Sample Size
- Approximately 383,000 disclosed CVEs from 1999 through September 2026, including 2,056 exploited-in-the-wild CVEs.
- Key Statistics
- About 77% of CVEs in the published population affected application code and 23% affected OS or system code.
- Server-side RCE represented 37% of exploited CVEs, compared with 20% of published CVEs; local privilege escalation represented 18% versus 11%, and client-side RCE 13% versus 4%.
- Remote code execution, authentication bypass, and local privilege escalation accounted for 78% of real-world exploited vulnerabilities.
- Median patching took about two weeks on Windows workstations, more than a month on Windows Servers, 10+ weeks on Linux Servers and applications running on MacOS, and more than a year on network appliances.
- VulnCheck reported that 29% of exploits in 2025 launched within one day of CVE publication. CISA’s mean time from CVE publication to KEV listing fell from 89 days in 2024 to 57 days in 2025 and 20 days through September 2026; the 2026 median was 3 days.
- Recommendations
- Prioritize patching vulnerabilities that enable remote code execution, authentication bypass, or local privilege escalation.
- Continuously identify internet-facing assets and remove unnecessary exposure before reachable vulnerabilities become entry points.
- Prioritize remediation using exploitability and threat signals, internet exposure, breach likelihood, and asset criticality rather than CVSS alone.
- Use attack-path analysis to identify and break routes from exposed assets through privileged identities to sensitive data or other critical resources.
Vendors
Products
Defender CSPMWithin cloud environments, Defender CSPM Attack Path Analysis adds detailed context about internet exposure, vulnerabilities, network connections, identities, and permissions across Azure, AWS, and Google Cloud.Defender for Endpointcloud, and hybrid environments, using vulnerability context from MDVM, endpoint data from Defender for Endpoint, and cloud asset data from Defender for Cloud.Microsoft Defender External Attack Surface ManagementMicrosoft Defender External Attack Surface Management approaches the environment from that same outside-in perspective, continuously discovering internet-facing infrastructure, including previously unknown orMicrosoft Defender for Cloudcontext from MDVM, endpoint data from Defender for Endpoint, and cloud asset data from Defender for Cloud.Microsoft Defender Vulnerability ManagementMicrosoft Defender Vulnerability Management addresses this challenge through Exposure Score and prioritized security recommendations.Microsoft Security Exposure ManagementMicrosoft Security Exposure Management data from 2026 shows that the median vulnerability is patched in about two weeks on Windows workstations but in more than a month on Windows Servers.