Microsoft Analysis Reveals Exploited Vulnerabilities Follow Predictable Patterns
Microsoft's extensive analysis of over 383,000 disclosed vulnerabilities shows that only a small fraction are actively exploited, with threat actors heavily favoring flaws that enable system takeover.
Microsoft has released a data-driven analysis of software vulnerabilities, revealing that a mere 0.5% of the approximately 383,000 disclosed CVEs between 1999 and September 2026 have been linked to real-world exploitation. This finding underscores a critical reality for cybersecurity defenders: not all vulnerabilities pose an equal threat, and understanding exploitation patterns is key to effective defense.
The analysis classified vulnerabilities by their impact class and the platforms they affect. Impact classes range from remote code execution (RCE) and privilege escalation to information disclosure and denial of service. The study found that threat actors disproportionately target flaws that offer the greatest control over a system, such as server-side RCE, local privilege escalation, and authentication bypass. These "takeover" classes, while representing a significant portion of disclosed vulnerabilities, are even more heavily represented among those actively exploited in the wild.
Conversely, vulnerability types like cross-site scripting (XSS) and denial of service (DoS), which are more numerous in the overall disclosed vulnerability population, are exploited far less frequently. For instance, server-side RCE jumped from 20% of published CVEs to 37% of exploited CVEs, while XSS dropped from 15% to 4%. This shift highlights a strategic focus by attackers on vulnerabilities that provide a direct path to system compromise and further attack stages.
The research also noted that most vulnerabilities affect application code, including servers, web applications, browsers, and libraries, rather than operating system kernels or drivers. This distribution suggests that the attack surface for exploited vulnerabilities is often found within the software users interact with daily or that forms the backbone of web services.
Microsoft emphasized that the window between vulnerability disclosure and exploitation is rapidly shrinking, exacerbated by advancements in AI-assisted vulnerability discovery and exploit development. While patching remains a fundamental security practice, the reality of slow remediation cycles on critical systems and the inability to patch legacy or unsupported systems means defenders must prioritize protection efforts. The analysis advocates for focusing resources on vulnerabilities that have both a high likelihood of exploitation and a significant potential blast radius.
Understanding the demonstrated impact and exploitability of a vulnerability, rather than solely relying on its stated classification, is crucial for effective prioritization. This nuanced approach allows security teams to allocate resources more efficiently, concentrating on the threats that pose the most immediate and severe risks to their organizations.
Microsoft's Security division offers various tools and services to aid defenders in this prioritization, aiming to help organizations stay ahead of rapidly evolving threats. The analysis serves as a stark reminder that while the volume of disclosed vulnerabilities is immense, the active threat landscape is more concentrated and demands a strategic, data-informed defense.