Microsoft analyzes 383,000 vulnerabilities, finding 78% exploited are takeover types
Original title: Microsoft Analyzes 383,000 Security Vulnerabilities and Reveals Which Flaws Hackers Exploit Most
Takeover vulnerabilities including RCE account for 78% of exploited CVEs, with OS code representing 41% of exploited despite 23% of disclosures.
Microsoft analyzed approximately 383,000 disclosed vulnerabilities from 1999 through September 2026 and identified 2,056 with real-world exploitation. Takeover vulnerabilities such as remote code execution, authentication bypass, and local privilege escalation make up 78% of exploited cases. Server-side RCE represents 37% of exploited CVEs while OS and system code account for 41%. Median remediation times range from two weeks on Windows workstations to over ten weeks on Linux servers. Microsoft warns that AI-assisted discovery may further reduce response windows.
Unconfirmed: Classifications alone insufficient for practical exploitability; AI-assisted discovery could compress response windows
- 78% of exploited vulnerabilities are takeover types
- Server-side RCE is 37% of exploited CVEs
- OS vulnerabilities represent 41% of exploited despite 23% of disclosures
- Median remediation: 2 weeks Windows workstations, over 10 weeks Linux servers
- 28.96% of 2025 first-time exploited vulnerabilities used before CVE publication
Impact: takeover vulnerabilities such as remote code execution
- Vendors
- Microsoft
From the original article
3 min read at gbhackers.com
Microsoft’s analysis of approximately 383,000 disclosed vulnerabilities shows that attackers overwhelmingly favor weaknesses enabling system takeover rather than exploiting vulnerabilities indiscriminately. The research identifies 2,056 CVEs linked to real-world exploitation, roughly 0.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.