Microsoft said on Nov. 2 that about 0.5% of the roughly 383,000 CVEs disclosed since 1999 are linked to real-world exploitation, and most of those let an attacker take over a system. Our reading: rank the queue by what a flaw gives an attacker and where the asset sits, and shield the slowest-patched servers and appliances.
What did Microsoft find?
In a blog analysis, Microsoft Security Research counted 2,056 exploited CVEs through September 2026 in its own catalog, not NVD, assigning each the most consequential impact it directly enables. No outside source confirms Microsoft's figures.
Microsoft's shares of published versus exploited CVEs:
Class | Published | Exploited |
|---|---|---|
Server-side remote code execution (RCE) | 20% | 37% |
Local privilege escalation | 11% | 18% |
Client-side RCE | 4% | 13% |
Cross-site scripting | 15% | 4% |
Denial of service | 16% | 7% |
OS and system code | 23% | 41% |
Microsoft said takeover vulnerabilities "like" RCE, authentication bypass and local privilege escalation account for 78% of exploited CVEs, but did not list the classes summed. By our arithmetic, its Figure 3 count of 1,239 remote-takeover CVEs (about 60%) plus 18% privilege escalation makes about 78%, so the sum likely includes client-side RCE. That is our inference, not Microsoft's.
Microsoft cautioned that some CVEs described as RCE may give only denial of service in practice, so demonstrated impact and exploitability matter more than the label.
How slow is patching next to exploitation?
Microsoft said its 2026 Exposure Management data shows median patch times of about two weeks on Windows workstations, more than a month on Windows Server, 10-plus weeks on Linux servers and macOS applications, and beyond a year on network appliances. It gave no sample size or method.
VulnCheck wrote that 28.96% of KEVs in 2025 were exploited on or before the day their CVE was published, out of 884 that its own KEV list, broader than CISA's, first recorded as exploited that year. Microsoft, citing CISA, gave falling average times to the KEV catalog and a 3-day median for 2026 but linked no CISA source. It credited unnamed "industry research" with AI shortening exploit development.
Our analysis of the CISA KEV feed (version 2026.10.30, dates from CVE.org): half of the listed CVEs published each year since 2024 reached the catalog within 4 to 11 days. By our reading, the falling averages partly reflect newer CVEs having had less time to be added, not proof of a speedup. What holds is the gap: days to the list, months or more to patch the slowest platforms.
Who is affected?
Any company with a patch backlog, above all on servers and network appliances.
What to do now
Our recommendation, built on Microsoft's figures:
- Vulnerability management, this week: sort the queue by impact class and exposure, not CVSS alone. Put RCE, authentication bypass and privilege escalation on internet-facing and identity-bearing systems first, using CISA's KEV catalog and your exposure list. Check demonstrated impact before trusting an RCE label.
- Infrastructure and network team, within 30 days: list the assets that patch slowest (network appliances, Linux servers). Where a patch cannot land in days, take it off the internet where possible and restrict management interfaces to an admin network.
- Identity team, within 30 days: review the service accounts, application identities and cloud-managed identities on those servers, and cut each to what its service needs. Microsoft noted they often hold excess permissions, which widen the damage of one RCE.
- CISO, at the next exception review: accept an unpatchable-system exception only with a named compensating control and an expiry date. Add availability-critical systems and exposed credentials or secrets next, the two slices Microsoft ranks after takeover.
