What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks
Exploited CVEs are concentrated in takeover classes such as server-side RCE and privilege escalation.
From 1999 through September 2026, approximately 383,000 software vulnerabilities were disclosed, yet only about 2,000 CVEs were linked to real-world exploitation. Threat actors disproportionately target flaws that enable system takeover, particularly remote code execution, privilege escalation, and authentication bypass. The analysis classified vulnerabilities by impact class and affected platform. Server-side RCE rose from 20% of published CVEs to 37% of exploited CVEs, while local privilege escalation increased from 11% to 18%. OS vulnerabilities rose from 23% to 41% of exploited vulnerabilities.
- Fewer than 1 in 200 published CVEs are used in real attacks.
- Exploitation favors vulnerabilities providing greater system control.
- Analysis covers CVEs published through September 2026.
- Most exploited CVEs concentrate in application code and OS/system code.
Impact: System takeover via RCE and privilege escalation
From the original article
8 min read at microsoft.com
Real-world exploitation concentrates in a small, high-impact subset of CVEs. Learn how defenders can prioritize vulnerabilities based on exploitation likelihood, exposure, and potential blast radius. The post What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks appeared first on Microsoft Security Blog.
By Microsoft Security Research, Yair Tsarfaty and Or Begam · microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.