What Exploited Vulnerabilities Have in Common: a Data-Driven Analysis of Real-World Attacks

Analysis of approximately 383,000 disclosed software vulnerabilities shows that fewer than 0.5% have been exploited in real-world attacks, with threat actors primarily targeting flaws that enable system takeover such as remote code execution, privilege escalation, and authentication bypass. Exploitation occurs rapidly—often within days of disclosure—while patching critical systems can take weeks to months, underscoring the need for defenders to prioritize remediation based on the potential impact and exposure of vulnerabilities, focusing especially on those that allow full control over highly exposed systems. Microsoft’s security tools assist defenders by continuously discovering internet-facing assets, prioritizing vulnerabilities using exposure and exploitability data, and analyzing attack paths to prevent compromise from spreading within environments.

https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/