Exploited Vulnerabilities: Key Patterns Defenders Must Know

Introduction

Microsoft Security’s new data-driven analysis helps explain a problem many IT and security teams face every month: there are too many vulnerabilities to treat equally. Out of roughly 383,000 disclosed CVEs through September 2026, only about 2,000 have been linked to real-world exploitation. The key takeaway is clear: defenders need to prioritize the vulnerabilities most likely to be weaponized and most likely to cause broad compromise.

What’s new in Microsoft’s analysis

Microsoft reviewed vulnerabilities across two dimensions: impact class and affected platform. The research found that exploited vulnerabilities look very different from the overall CVE population.

Attackers prefer takeover vulnerabilities

The most exploited flaws are those that give attackers meaningful control over systems, including:

• Server-side remote code execution (RCE)
• Client-side RCE
• Local privilege escalation
• Authentication or authorization bypass

By contrast, lower-impact categories such as cross-site scripting (XSS) and denial of service (DoS) appear far less often in real-world exploitation.

OS and critical infrastructure matter more

Microsoft found that OS-level vulnerabilities make up a larger share of exploited flaws than they do in the total CVE population. That reinforces a familiar pattern: attackers focus on weaknesses that can create durable footholds and support lateral movement.

Exploitation is getting faster

The report highlights a shrinking response window:

• Exploits are increasingly appearing within days, or even on disclosure day
• CISA KEV timing has dropped significantly, showing faster attacker adoption
• AI-assisted vulnerability research may accelerate exploit development further

Why this matters for IT administrators

For administrators, the challenge is not just identifying vulnerable assets, but identifying the ones that combine high impact with high exposure. Servers, network appliances, and other critical systems are often the slowest to patch, yet they offer attackers the greatest blast radius if compromised.

This is especially important in environments where:

• Servers run with overprivileged service or managed identities
• Legacy systems cannot be patched quickly
• Internet-facing services increase exposure
• Critical infrastructure has long remediation timelines

Recommended next steps

Security and IT teams should adjust vulnerability prioritization around exploitability and business impact, not CVE volume alone.

• Prioritize RCE, privilege escalation, and auth bypass flaws first
• Focus on internet-facing servers, appliances, and identity-connected systems
• Review identity permissions on servers and applications to reduce blast radius
• Use compensating controls where patching is delayed
• Track threat intelligence and known exploited vulnerability catalogs more closely

Microsoft’s analysis is a useful reminder that effective vulnerability management is about precision, not just patch counts. The fastest path to risk reduction is focusing on the small subset of flaws attackers are most likely to exploit.