Microsoft Analysis Reveals Which Vulnerabilities Attackers Exploit Most

Not every disclosed software vulnerability becomes a target for cybercriminals. However, the vulnerabilities that attackers do exploit tend to share a common characteristic: they provide a path to meaningful control over systems, identities or sensitive resources.

A new analysis from Microsoft Security Research examines this pattern across vulnerabilities disclosed from 1999 through September 2026. The research finds that approximately 383,000 software vulnerabilities had been disclosed during this period, but only about 2,000 Common Vulnerabilities and Exposures (CVEs), roughly 0.5% of the total, were linked to real-world exploitation.

The findings show that attackers disproportionately target vulnerabilities that enable remote code execution (RCE), local privilege escalation and authentication bypass. These flaws can provide access that supports further compromise across an organisation's environment.

Microsoft also highlights a growing challenge for defenders: exploitation can happen within days of vulnerability disclosure, while remediation on critical systems may take weeks, months or even longer.

The research argues that vulnerability management should therefore consider more than the number of flaws or their severity scores. Organisations need to understand what successful exploitation could allow an attacker to do, which assets are exposed and how far a compromise could spread.

How Microsoft Classified the Vulnerability Landscape

To make the large vulnerability population easier to analyse, Microsoft examined CVEs across two dimensions: impact class and affected platform.

Impact class describes the most consequential outcome that a threat actor could directly achieve by exploiting a vulnerability. For example, if a vulnerability can bypass authentication and directly enable remote code execution, Microsoft classifies it as RCE.

This approach focuses on the security impact an attacker could achieve rather than only the underlying technical weakness.

Vulnerability Impact Categories

Microsoft's analysis includes the following impact classes:

• Server-side remote code execution: Executing code on a network-exposed service without requiring user interaction.

• Client-side remote code execution: Executing code after a user opens or runs malicious content.

• Local code execution: Executing code or commands with local access or an existing foothold.

• Local privilege escalation: Gaining higher privileges, such as SYSTEM or root, from lower-level access.

• Authentication or authorization bypass: Circumventing authentication mechanisms or access controls.

• Security-control bypass: Circumventing protections such as sandboxing, secure boot or SmartScreen.

• Information disclosure: Exposing sensitive data or secrets.

• Tampering or integrity: Modifying data or system state without authorization.

• Denial of service: Disrupting a system or service's availability.

• Cross-site scripting (XSS): Executing scripts within a victim's browser context.

• Arbitrary file access: Accessing or placing files without authorization.

• Spoofing or redirect: Using spoofing, redirection or other forms of user-interface deception.

Microsoft also grouped vulnerabilities by affected platform, including Windows, Linux/Unix, mobile devices, network appliances, IoT/OT, virtualization hosts and developer packages.

A single CVE can affect multiple platforms. Developer packages were treated as a separate category because they are often cross-platform and represent a significant part of the vulnerability population.

Application Vulnerabilities Account for Most Disclosures

The analysis found that most disclosed CVEs affect application code, including servers, web applications, browsers, productivity software, libraries and firmware tooling.

A smaller proportion affects operating system and system code, such as kernels, drivers and firmware.

Across the full population of 382,789 published CVEs represented in Microsoft's first figure:

• 77% affected application code.

• 23% affected operating system and system code.

This distribution provides a view of where disclosed vulnerabilities exist. However, Microsoft's analysis shows that the distribution changes considerably when examining only vulnerabilities exploited in real-world attacks.

Which Vulnerabilities Are Most Often Exploited?

The difference between the full vulnerability population and the exploited subset is significant.

Microsoft identified 2,056 CVEs linked to real-world exploitation. These represent approximately 0.5% of the published vulnerabilities included in the analysis.

However, this smaller group has a noticeably different impact distribution.

Attackers show a stronger preference for vulnerabilities that enable system takeover or provide elevated access.

Microsoft's comparison found:

The figures show that server-side RCE rises from 20% of the overall vulnerability population to 37% of exploited vulnerabilities. Local privilege escalation increases from 11% to 18%, while client-side RCE rises from 4% to 13%.

By comparison, XSS falls from 15% to 4%, and denial of service declines from 16% to 7%.

The platform distribution also changes. Operating system vulnerabilities account for 23% of the overall CVE population but 41% of exploited vulnerabilities.

Why Attackers Favour Takeover Vulnerabilities

The pattern suggests that threat actors prioritise vulnerabilities based on what successful exploitation can achieve.

Remote code execution can give an attacker the ability to run commands or code on a compromised system. Local privilege escalation can turn an existing foothold into higher-level access. Authentication bypass can provide access without following the intended authentication process.

These capabilities can support additional stages of an attack, including access to sensitive resources and further movement through an environment.

Vulnerabilities that mainly cause service disruption or limited script execution may offer less value for broader system compromise. This helps explain why their share of exploited vulnerabilities is lower than their share of the overall disclosure population.

Microsoft also cautions that a vulnerability's formal classification does not always reflect the impact an attacker can reliably achieve in practice. Some vulnerabilities described as enabling RCE may result only in denial of service under real-world conditions.

Defenders therefore need to consider demonstrated impact and practical exploitability, not just the vulnerability label.

Why Defenders Have Less Time to Patch

Microsoft identifies a growing gap between the speed of exploitation and the time organisations need to remediate vulnerabilities.

Patching is particularly slow on critical systems. According to Microsoft Security Exposure Management data from 2026, the median time to patch a vulnerability varies considerably across platforms and asset types.

The reported figures are:

Servers are particularly important because they often support critical services and business operations. Yet the research identifies them as both critical assets and some of the slowest systems to patch.

Legacy and unsupported systems create another challenge because organisations may not be able to apply available security updates.

Exploitation Can Begin Within Days of Disclosure

While patching can take weeks or months, attackers may begin exploiting vulnerabilities much sooner.

Microsoft cites several external research findings to illustrate this difference:

• 29% of exploits in 2025 were launched within one day of CVE publication, according to VulnCheck's State of Exploitation 2026 report.

• The mean time between CVE publication and inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog fell from 89 days in 2024 to 57 days in 2025.

• For data through September 2026, the mean had fallen to 20 days, with a median of just 3 days.

Microsoft says industry research suggests advances in AI are a significant factor in reducing the time required to develop exploits.

This creates a difficult situation for security teams. The period between public disclosure and exploitation can be shorter than the time needed to identify affected systems, assess operational risks, test patches and deploy updates.

Impact and Exposure Should Guide Vulnerability Prioritisation

Microsoft argues that organisations should not prioritise vulnerabilities based on severity scores alone.

Instead, defenders need to consider two connected factors: impact and exposure.

Impact describes what an attacker could achieve after successful exploitation. This could include remote code execution, privilege escalation or access to sensitive information.

Exposure describes an asset's position within an organisation's environment and the opportunities it could provide for further compromise. It depends on the identities, privileges and connections available to that asset.

Together, these factors help determine the potential blast radius of a successful attack.

Why Server Exposure Matters

Servers frequently operate with service accounts, application identities or cloud-managed identities.

These identities may have permissions that extend beyond what the systems need to perform their normal functions.

If an attacker compromises a server with excessive permissions, the incident may provide access to other resources, sensitive data, administrative privileges or trusted network paths.

For example, a vulnerability that gives an attacker control of an internet-facing server may become more serious if that server also has access to privileged identities or critical internal resources.

The vulnerability's technical severity is only part of the risk. Its location, connected systems and available permissions can determine how far an attacker could move after gaining access.

Remote-Takeover Vulnerabilities Deserve Priority

Microsoft identifies remote code execution, authentication bypass and local privilege escalation as the main remote-takeover classes in its prioritisation discussion.

Together, these classes account for 78% of real-world exploited vulnerabilities, according to the research.

The company argues that addressing these vulnerabilities first can interrupt attacks at an early stage, before an initial compromise spreads across an environment.

Microsoft's analysis also identifies a second group of vulnerabilities that may deserve urgent attention depending on the affected asset.

Denial-of-service vulnerabilities can be especially serious when they affect availability-critical systems. Although service disruption may be recoverable in many environments, it could have severe consequences where continuous uptime is essential.

Information disclosure also requires context. A limited disclosure incident may be contained, but exposed credentials or secrets can provide a route to privileged identities and further compromise.

The key point is that vulnerability priority depends on both the potential outcome of exploitation and the role of the affected asset in the wider environment.

How Microsoft Security Helps Defenders Act

Microsoft describes several security capabilities intended to help organisations identify exposed assets, prioritise vulnerabilities and understand how attackers could move through their environments.

The approach begins with discovering what is reachable from outside the organisation.

Discover Internet-Facing Assets

Microsoft Defender External Attack Surface Management provides an outside-in view of an organisation's internet-facing infrastructure.

According to Microsoft, it continuously discovers exposed infrastructure, including previously unknown or unmonitored assets, shadow IT and third-party dependencies.

This helps defenders identify systems that may create unnecessary exposure before attackers find and exploit vulnerabilities in them.

Prioritise Vulnerabilities Beyond CVSS

Once exposed assets are identified, security teams need to determine which vulnerabilities require attention first.

Microsoft Defender Vulnerability Management uses Exposure Score and prioritised security recommendations to help assess risk beyond CVSS severity alone.

Microsoft says this prioritisation incorporates threat and exploitability signals, breach likelihood, internet exposure and asset criticality.

The objective is to help teams focus remediation efforts on vulnerabilities that create the greatest actual exposure.

Identify Attack Paths Across Environments

Finding an exposed vulnerability is only one part of understanding risk. Defenders also need to know what an attacker could reach after compromising an asset.

Microsoft Security Exposure Management Attack Path Analysis connects assets and threat actor techniques to show potential routes from an entry point to a critical resource.

Microsoft describes its cross-workload view as spanning endpoints, cloud and hybrid environments. It uses vulnerability context from Microsoft Defender Vulnerability Management, endpoint data from Microsoft Defender for Endpoint and cloud asset data from Microsoft Defender for Cloud.

Within cloud environments, Microsoft Defender CSPM Attack Path Analysis provides additional context about internet exposure, vulnerabilities, network connections, identities and permissions across Azure, AWS and Google Cloud.

Together, these capabilities are intended to help defenders understand how an exposed workload could become a route to privileged identities, sensitive data or other critical resources.

The broader approach is to identify the entry points attackers can see, determine which weaknesses matter most and find opportunities to break attack paths before an initial compromise expands.

What Security Teams Should Take Away

Microsoft's research highlights why vulnerability management needs to move beyond counting disclosed CVEs or working through patch lists based only on severity.

The findings point to several priorities for security teams:

• Focus on takeover vulnerabilities: Pay close attention to remote code execution, authentication bypass and privilege escalation flaws.

• Identify exposed assets: Understand which systems are reachable from the internet and which are not adequately monitored.

• Review identity permissions: Check the service accounts, application identities and cloud-managed identities connected to critical systems.

• Consider the potential blast radius: Assess what an attacker could access after compromising a vulnerable asset.

• Account for patching delays: Give critical servers and network appliances particular attention where remediation takes longer.

• Use contextual prioritisation: Combine exploitability, asset exposure, identity permissions and business criticality when deciding what to fix first.

Patching remains essential. However, Microsoft's analysis shows that remediation priorities should reflect the practical consequences of exploitation, not simply the number of vulnerabilities awaiting updates.

Conclusion

Microsoft's analysis of vulnerabilities disclosed through September 2026 reveals a clear difference between the broader vulnerability landscape and the flaws attackers actually exploit.

Only around 0.5% of published CVEs in the analysis were linked to real-world exploitation. Yet those exploited vulnerabilities are disproportionately concentrated in categories that provide system control, elevated privileges or ways around authentication.

The challenge for defenders is that exploitation can move faster than patching, particularly on critical servers and network appliances.

For organisations, the research reinforces the importance of understanding exposure, identity permissions and potential attack paths alongside vulnerability severity. Prioritising the weaknesses that could give attackers the greatest access may help security teams use limited remediation resources more effectively.