Microsoft finds just 2,000 CVEs linked to real world attacks

Microsoft Security researchers report that the vulnerability landscape continues to expand, with around 383,000 software vulnerabilities disclosed across platforms and technologies from 1999 to September 2026, yet only about 2,000 CVEs (roughly 0.5%) have been linked to real-world exploitation.

The researchers note that exploited vulnerabilities concentrate in takeover classes such as remote code execution, privilege escalation and authentication bypass, and that AI-assisted discovery could further shorten defenders’ response windows. Patching remains essential but can take weeks or months on critical systems, while weaponisation often occurs within days of disclosure, creating a narrow window for defenders to act. The piece stresses the need to prioritise protection where exploitation is most likely and where the blast radius would be greatest.

In their analysis, Microsoft Security classifies CVEs by impact class and affected platform, identifying server-side and client-side remote code execution, local code execution, local privilege escalation, authentication bypass, and other outcomes such as information disclosure, tampering, denial of service and cross-site scripting.

Figures accompanying the report show that exploited CVEs are disproportionately linked to takeover outcomes, with server-side RCE, local privilege escalation and authentication bypass accounting for the majority of real-world exploitation, and OS vulnerabilities becoming more prevalent among exploited cases. The researchers caution that a vulnerability’s stated classification may not reflect what attackers reliably achieve in practice.

The article highlights where defenders should focus, noting that patching delays are worst on servers and critical assets, while exploits are deployed quickly—often within days of CVE publication. Two guiding concepts are impact and exposure: assets with high impact and exposure—such as systems using elevated service or cloud identities—drive the largest blast radii. Takeover vulnerabilities driving the broadest exposure account for about 78% of real-world exploited CVEs.

The authors argue for breaking attack paths early and prioritising exposure-aware remediation, with Microsoft Security offering corresponding tools such as Defender External Attack Surface Management and Defender Vulnerability Management to help defenders prioritise, map attack paths, and cut off exploitation before compromise propagates. The report appears in Microsoft Security blogs authored by Yair Tsarfaty and Or Begam, with Microsoft Security Research involved in the publication.