What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks

What it is

A Microsoft Security Blog analysis (2 November 2026) of about 383,000 CVEs disclosed from 1999 to September 2026, of which about 2,000 (0.5%) were exploited in the wild. It uses Microsoft's catalog of tracked vulnerabilities and classifies each CVE once by its most consequential direct impact and by affected platform. Platforms are Windows, Linux/Unix, mobile, network appliances, IoT/OT, virtualization hosts and developer packages.

What the data shows

Takeover classes (remote code execution, privilege escalation, authentication bypass) account for 78% of exploited vulnerabilities. Shifts from all CVEs to exploited CVEs:

OS-level vulnerabilities rise from 23% of all CVEs to 41% of exploited ones.

Median time to patch, from Microsoft Security Exposure Management data for 2026:

• Windows workstations: about 2 weeks.
• Windows Servers: more than a month.
• Linux servers and macOS applications: 10+ weeks.
• Network appliances: more than a year.

Exploitation timing:

• VulnCheck: 29% of 2025 exploits were launched within 1 day of CVE publication.
• CISA: mean time from CVE publication to KEV listing was 89 days in 2024 and 57 days in 2025.
• For 2026 through September, the mean is 20 days and the median is 3 days.

The post cites industry research that AI is shortening exploit development time. It does not give figures for that.

What to do

The page recommends ranking work by impact and exposure, not by CVSS alone.

• Patch takeover vulnerabilities first, starting with those on servers, because servers patch slowest and often hold service accounts or cloud identities with excess permissions. Exposure here means an asset's identities, privileges and connections, which set the blast radius.
• Treat two further groups as context-dependent: denial of service against availability-critical assets, and disclosure of credentials or secrets, which feeds the privileged-identity path.
• Where patching cannot happen (legacy or unsupported systems), cut attack paths and remove unnecessary internet exposure instead.

The post maps these steps to Microsoft products: Defender External Attack Surface Management for discovering internet-facing assets, Defender Vulnerability Management for exposure-based prioritization, and Attack Path Analysis in Security Exposure Management and Defender CSPM. It gives no commands, queries or configuration.

Caveats

• The post says a CVE's stated class does not always match what an attacker can reliably achieve. Some described RCEs end up as denial of service in practice, so demonstrated exploitability should be checked.
• The patch-time data comes from Microsoft's own telemetry, and the exploited set is about 2,000 CVEs. The post does not say how "exploited in the wild" was determined beyond references to CISA KEV and VulnCheck.
• The product section is promotional, and the post names no specific CVEs.