What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks
Only about 0.5% of software vulnerabilities are actually exploited in real-world attacks, with threat actors overwhelmingly targeting flaws that enable system takeover, according to Microsoft's analysis of 383,000 disclosed CVEs.
From 1999 through September 2026, approximately 383,000 software vulnerabilities had been disclosed across platforms and technologies, yet only about 2,000 CVEs (roughly 0.5%) have been linked to real-world exploitation. These exploited vulnerabilities follow clear patterns, with threat actors disproportionately targeting flaws that enable system takeover, particularly remote code execution, privilege escalation, and authentication bypass.
AI-assisted vulnerability discovery and exploit development could further shorten the window defenders have to respond. While patching remains essential, remediation can take weeks or months on critical systems, and some legacy or unsupported systems cannot be patched at all.
Exploitation Patterns
The subset of vulnerabilities exploited in the wild is much smaller than the overall CVE population and looks very different from it. Server-side RCE rises from 20% of published CVEs to 37% of exploited CVEs, local privilege escalation from 11% to 18%, and client-side RCE from 4% to 13%. By comparison, XSS falls from 15% to 4% and denial of service from 16% to 7%.
Understanding the demonstrated impact and exploitability of a vulnerability is therefore critical to effective prioritization.
Patching Challenges
Patching is slow, and far slower on critical systems than others. Across platforms, servers are the critical assets and the slowest to patch. Microsoft data shows that the median vulnerability is patched in about two weeks on Windows workstations but in more than a month on Windows Servers. It stretches to 10+ weeks on Linux Servers and for applications running on MacOS, and beyond a year on network appliances.
Exploitation runs on the opposite clock: the most impactful vulnerabilities are weaponized in days. According to CISA, the mean time from CVE publication to CISA KEV catalog fell from 89 days in 2024 to 57 days in 2025. 2026 data shows that number dropping to 20 days, with a median of only 3 days since publication.
Defender Focus
Two things determine a vulnerability's value to a threat actor: impact and exposure. Impact is what successful exploitation provides, such as remote code execution or privilege escalation. Exposure is an asset's position in the environment and the opportunities it creates for further compromise.
Takeover vulnerabilities like remote code execution, authentication bypass and local privilege escalation account for 78% of real-world exploited vulnerabilities. Stopping their exploitation interrupts attacks at the earliest stage, before compromise can propagate across the environment. A second slice deserves attention where context makes it severe: denial of service against availability-critical assets or disclosure of credentials that can feed privileged-identity paths.
Related
