What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks

What happened?

In this article Classifying the vulnerability landscape Vulnerabilities exploited in the wild Where defenders should focus Patching is slow, while exploitation is fast Impact, exposure and where to focus Next in line How Microsoft Security helps defenders act References Learn More The vulnerability landscape continues to expand. From 1999 through September 2026, approximately 383,000 software vulnerabilities had been disclosed across platforms and technologies, yet only about 2,000 CVEs (roughly 0.5%) have been linked to real-world exploitation. Those vulnerabilities follow clear patterns.

Key details

• Only about 2,000 of roughly 383,000 disclosed CVEs have been linked to real-world exploitation.
• Exploited vulnerabilities concentrate in takeover classes like server-side RCE, local privilege escalation, and client-side RCE.
• Median patching time on Windows workstations is about two weeks but exceeds a month on Windows Servers and reaches 10+ weeks on Linux Servers.
• 29% of exploits in 2025 were launched within one day of CVE publication, and mean time to CISA KEV catalog dropped to 20 days in 2026.
• Takeover vulnerabilities account for 78% of real-world exploited CVEs and drive the largest blast radius.
• AI-assisted vulnerability discovery and exploit development are shortening the window defenders have to respond.

Summarised by SecOraLens from Microsoft Security. Always read the original source before acting. How SecOraLens verifies advisories.