What Exploited Vulnerabilities Have in Common: A Data-Driven Analysis of Real-World Attacks
Microsoft, Monday, November 2nd, 2026
Microsoft analyzes which CVEs get exploited, finding about 0.5 percent of disclosed vulnerabilities are linked to real-world attacks.
Microsoft says roughly 383,000 vulnerabilities were disclosed from 1999 through September 2026, but only about 2,000 CVEs have been linked to real-world exploitation.
Attackers disproportionately target flaws enabling system takeover, especially remote code execution, privilege escalation and authentication bypass.
Because patching can take weeks or months and some systems cannot be patched, Microsoft urges defenders to prioritize by exploitation likelihood, exposure and blast radius.
Its analysis classifies each CVE by impact class and by affected platform, such as Windows, Linux, mobile, network appliances, IoT and developer packages.