Only 0.5% of flaws get exploited, and they look alike

Microsoft has published an analysis of which vulnerabilities attackers actually use. From 1999 to September 2026 about 383,000 software vulnerabilities were disclosed, and only about 2,000 CVEs, roughly 0.5 percent, have been linked to real-world exploitation. Microsoft classified each one by the impact it gives an attacker and by the platform it affects, and compared the exploited subset, 2,056 CVEs, with the whole population.

The exploited set looks very different. Server-side remote code execution rises from 20 percent of published CVEs to 37 percent of exploited ones, local privilege escalation from 11 to 18 percent and client-side code execution from 4 to 13 percent. Cross-site scripting falls from 15 to 4 percent and denial of service from 16 to 7 percent. Flaws in operating-system code rise from 23 percent of all CVEs to 41 percent of exploited ones. Takeover classes, meaning remote code execution, authentication bypass and privilege escalation, account for 78 percent of exploited vulnerabilities.

The second finding is about time, and the clocks run in opposite directions. Microsoft's 2026 data puts the median time to patch at about two weeks on Windows workstations, more than a month on Windows servers, more than ten weeks on Linux servers and for macOS applications, and beyond a year on network appliances. Exploitation is getting faster: citing VulnCheck, 29 percent of exploits in 2025 were launched within a day of CVE publication, and citing CISA data, the mean time from publication to the Known Exploited Vulnerabilities catalogue fell from 89 days in 2024 to 57 days in 2025 and to 20 days so far in 2026, with a median of three days. Microsoft says industry research points to AI as a significant factor in that acceleration.

The practical conclusion is about order, not volume: patch the flaws that give full control of exposed systems first, especially servers whose identities reach further into the network. Microsoft also cautions that a stated classification does not always match what an attacker can achieve, since some flaws labelled as code execution yield only a crash in practice. The analysis uses Microsoft's own catalogue and telemetry, and it closes by recommending Microsoft's exposure-management products.