AnalysisPublished 2 Nov 2026

What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks

Source Microsoft Security Blog

Description

This analysis from Microsoft Security Research examines the characteristics of software vulnerabilities that have been exploited in real-world attacks. Out of approximately 383,000 disclosed vulnerabilities through September 2026, only about 2,000 (0.5%) have been linked to actual exploitation. Exploited vulnerabilities disproportionately enable system takeover, such as remote code execution (RCE), privilege escalation, and authentication bypass. The study classifies vulnerabilities by impact and platform, highlighting that exploitation is concentrated in vulnerabilities that provide attackers with significant control. Patching remains critical but is often slow, necessitating focused defensive efforts on high-impact vulnerabilities.

Impact

The impact of exploited vulnerabilities is significant as they often enable attackers to gain control over systems through remote code execution, privilege escalation, or authentication bypass. Such vulnerabilities facilitate footholds for further attacks and broader compromise. The exploited vulnerabilities are concentrated in classes that maximize attacker control and exposure, increasing the risk of system takeover and data breaches. Vulnerabilities causing less impactful outcomes, such as cross-site scripting or denial of service, are less frequently exploited in the wild. The slow pace of patching critical systems exacerbates exposure to these high-impact vulnerabilities.

Defensive guidance

Patching remains essential to mitigate these vulnerabilities; however, remediation can be slow, especially for critical or legacy systems. Defenders should prioritize patching and protection efforts on vulnerabilities that enable system takeover, such as remote code execution and privilege escalation, as these represent the highest exploitation risk. Focused defensive measures should consider both the likelihood of exploitation and the potential impact of a successful attack. Organizations should also assess the demonstrated exploitability and impact of vulnerabilities rather than relying solely on their classification.

Summary

Microsoft's data-driven analysis categorizes nearly 383,000 CVEs by impact class and affected platform, revealing that only a small fraction (~0.5%) are exploited in the wild. Exploited vulnerabilities are heavily skewed towards those enabling system takeover, particularly server-side RCE, local privilege escalation, and client-side RCE. The analysis distinguishes impact classes such as authentication bypass, security-control bypass, information disclosure, tampering, denial of service, and others, and maps these across platforms including Windows, Linux/Unix, mobile, IoT/OT, and developer packages. The exploited subset shows a marked increase in OS vulnerabilities and takeover classes compared to the overall population. The study emphasizes the importance of understanding demonstrated impact and exploitability for prioritization, noting that some vulnerabilities classified as RCE may only cause denial of service in practice. It also highlights the challenge of slow patching versus rapid exploitation, especially on legacy or unsupported systems.

References

microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 2 Nov 2026, 21:43 UTC

Technical details

References

Community reviews

Related threats