Microsoft’s latest research reveals that nearly 78% of software vulnerabilities that are actively being exploited allow attackers to either take full control of systems or escalate their privileges. The study, published on November 2, 2026, shows that over the past decades, of the roughly 383,000 vulnerabilities disclosed since 1999 through September 2026, only about 2,000 — roughly 0.5% — have ever been used in real-world attacks. This indicates that a small fraction of bugs causes most of the damage.
Of all exploited vulnerabilities, those in operating system code make up about 41%, compared to just 23% among all known bugs. Remote code execution (RCE) on server-side systems accounts for 37% of exploited flaws, up from 20% in the broader vulnerability pool. Local privilege escalation increases from 11% to 18%, while client-side RCE jumps from 4% to 13%. In contrast, less severe types like cross-site scripting and denial of service drop sharply in the exploited group.
Patching Lag Remains a Massive Risk Window
Attackers are striking fast. While the median time to patch flaws on Windows desktops is about two weeks, for Windows servers it’s well over a month. Linux servers and macOS applications often wait more than ten weeks. Network appliances can go unpatched for over a year. Yet exploits are showing up much sooner: In 2026, the average time between a vulnerability’s public disclosure and its entry into key exploit catalogs is around 20 days, with a median of just 3 days.
Defenders face a squeeze not just on patch timelines but also around the true impact of vulnerabilities. Not all bugs labeled as remote execution actually allow full system takeover; some might only crash a system. Despite labeling, Microsoft urges security teams to assess what attackers can truly do when prioritizing fixes.
Where Teams Should Focus First
Microsoft’s recommendation is clear: flaws that allow system takeover or elevate privileges must be patched first. These vulnerabilities make attackers’ jobs substantially easier, opening paths to sensitive data, higher permissions, or infrastructure access. Denial of service or credential leaks still matter, but are secondary unless they enable lateral movement or identity compromise.
To sharpen defenses, Microsoft suggests tools like External Attack Surface Management to find all internet-facing assets—including shadow IT and third-party dependencies. Vulnerability Management should go beyond just CVSS (Common Vulnerability Scoring System), factoring in signals like exploit availability, exposure, and the value of the affected assets. Attack Path Analysis is also recommended to map how a breached system might lead to critical data through privileged identity paths.
These findings underscore that in cybersecurity, what matters most isn’t how many bugs are out there—it’s which ones are being exploited, how fast, and how they enable attackers to escalate. Microsoft’s research makes it clear: not all flaws are equal, and prioritizing the wrong ones carries real risks.
