Network appliances stay unpatched for over a year as exploits speed up
Original title: Network appliances go more than a year without patches as exploits speed up
Microsoft analysis of 383,000 CVEs shows median patch time for network appliances exceeds one year while exploitation occurs in days.
Microsoft’s telemetry from roughly 383,000 CVEs disclosed from 1999 through September 2026 found the median vulnerability on enterprise network appliances stays unpatched for more than a year. The most damaging flaws are weaponized within days of disclosure. Median patch times exceed a year for network appliances, over a month for Windows servers, over 10 weeks for Linux servers and macOS apps, and about two weeks for Windows workstations. Exploitation mean time from CVE publication to CISA KEV catalog dropped to 20 days with median three days in 2026. AI advances contribute to faster exploit development. Server-side RCE accounts for 37 percent of exploited CVEs versus 20 percent published.
- Median patch time exceeds one year for network appliances
- Mean time from CVE to CISA KEV catalog fell to 20 days in 2026
- Median exploitation time dropped to three days
- 29 percent of exploits launched within one day of CVE publication in 2025
- Server-side RCE is 37 percent of exploited CVEs versus 20 percent published
| Product | Affected |
|---|---|
| Microsoft network appliances | — |
- 1.Move away from monthly scans and scheduled patch cycles
- 2.Implement continuous monitoring and emergency patching procedures
- 3.Use virtual patching through WAF and IPS controls
- Vendors
- Microsoft
- Organizations
- Microsoft Security Research
From the original article
3 min read at csoonline.com
The median vulnerability on enterprise network appliances stays unpatched for more than a year, Microsoft’s own telemetry shows, even as the most damaging software flaws are being weaponized within days of disclosure. Microsoft Security Research reported the findings Monday in an analysis of roughly 383,000 CVEs disclosed from 1999 through September 2026.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.