Of roughly 383,000 software vulnerabilities disclosed between 1999 and September 2026, only about 2,000 have been linked to real-world attacks, and those few look strikingly alike. That is the headline finding of a new data-driven analysis by Microsoft Security Research, Yair Tsarfaty and Or Begam, which argues that defenders can stop treating the CVE firehose as one undifferentiated backlog.
Fewer than 1 in 200 published CVEs are ever used in a real attack, Microsoft found. The ones that are skew heavily toward bugs that hand an attacker control of a machine.
Attackers pick the bugs that hand them the keys
The researchers classified every CVE in Microsoft's catalog by the most serious outcome it directly enables, then compared the full population with the 2,056 CVEs exploited in the wild. The shift is sharp:
- Server-side remote code execution (running code on a network-exposed service with no user involvement) rises from 20% of published CVEs to 37% of exploited ones.
- Local privilege escalation rises from 11% to 18%.
- Client-side remote code execution, which needs a user to open or run malicious content, rises from 4% to 13%.
- Cross-site scripting falls from 15% to 4%, and denial of service from 16% to 7%.
Operating system vulnerabilities follow the same pattern, climbing from 23% of all CVEs to 41% of exploited ones. Taken together, what Microsoft calls takeover vulnerabilities (remote code execution, authentication bypass and local privilege escalation) account for 78% of real-world exploited vulnerabilities. The researchers also caution that a CVE's stated class does not always match what an attacker can reliably achieve: some bugs described as enabling code execution turn out to deliver only denial of service under real-world conditions.
The servers that matter most get patched last
The study's sharpest point is about timing. Microsoft Security Exposure Management data from 2026 shows the median vulnerability is patched in about two weeks on Windows workstations but in more than a month on Windows Servers. It stretches to over 10 weeks on Linux servers and for applications running on macOS, and beyond a year on network appliances, the class of device behind incidents such as the FortiMail zero-day that was exploited before a patch existed.
Exploitation runs on a much faster clock. Microsoft cites VulnCheck data showing 29% of exploits in 2025 were launched within one day of CVE publication, and CISA figures showing the mean time from CVE publication to a Known Exploited Vulnerabilities (KEV) catalog listing fell from 89 days in 2024 to 57 days in 2025. For 2026 through September, Microsoft says, that mean has dropped to 20 days, with a median of only three. The company adds that industry research points to AI as a significant factor in shrinking the time it takes to develop exploits.
Fix takeover bugs on exposed servers first
Microsoft's prescription is to rank remediation by two things: impact (what exploitation gives the attacker) and exposure (what the compromised asset can reach, including the identities and privileges it holds). Servers often run service accounts, application identities or cloud-managed identities with more permissions than they need, so a takeover bug on an exposed server can become a path to sensitive data, administrative privileges or the cloud. In practice, that means:
- Prioritise remote code execution, authentication bypass and privilege escalation flaws on internet-facing and highly privileged systems, rather than working by CVSS score alone.
- Find and remove unnecessary internet exposure, including forgotten assets and shadow IT, before a reachable flaw becomes an entry point.
- Map attack paths from exposed assets to critical ones, so a compromise can be cut off before it spreads.
- Treat denial of service against availability-critical assets, and leaks of credentials or secrets, as the next tier, since context can make either severe.
None of this replaces patching, which the researchers call essential. But with legacy systems that cannot be patched and appliances that take a year to update, the analysis makes a practical case: the vulnerabilities attackers actually use are a small, predictable minority, and defenders who start there are working from the same short list as the attackers.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.