Only 1 in 200 Vulnerabilities Ever Gets Used in an Attack. Microsoft’s Data Shows Which Ones, and Why Servers Are the Weak Spot
Microsoft analyzed about 383,000 disclosed vulnerabilities and found only around 2,000 linked to real attacks, overwhelmingly the kind that hand over control of a system. With exploitation getting faster and server patching staying slow, here is how a layered approach closes the gap.
Here Is How Layered Defenses Help When Patching Cannot Keep Up
Every month brings another long list of security patches, and small IT teams cannot fix everything at once. A new analysis from Microsoft’s security researchers offers a way to decide what comes first, along with an uncomfortable finding about how long the most important machines stay exposed.
The figures below come from Microsoft’s data-driven study of exploited vulnerabilities, published on its Security Blog.
Six findings, one at a time
- Very few flaws are ever used. Of roughly 383,000 vulnerabilities disclosed from 1999 through September 2026, only about 2,000, around half a percent, have been tied to real-world attacks.
- Attackers want control. Server-side remote code execution makes up 20% of all published CVEs but 37% of exploited ones. Local privilege escalation rises from 11% to 18%, and client-side remote code execution from 4% to 13%. Cross-site scripting and denial-of-service bugs shrink sharply in the exploited group.
- Takeover bugs dominate. Remote code execution, authentication bypass and privilege escalation together account for 78% of exploited vulnerabilities. Operating system flaws also climb, from 23% of all CVEs to 41% of exploited ones.
- Servers get patched last. Microsoft’s 2026 data puts the median time to patch at about two weeks on Windows workstations, more than a month on Windows servers, ten weeks or more on Linux servers and Mac applications, and over a year on network appliances.
- Attackers are getting faster. Microsoft cites VulnCheck figures showing 29% of 2025 exploits launched within a day of a CVE being published, and CISA data showing the average time from publication to its Known Exploited Vulnerabilities list falling from 89 days in 2024 to 57 in 2025, and to 20 days so far in 2026, with a median of three. Industry research points to AI as a significant factor.
- Labels can mislead. A flaw described as remote code execution may only crash a system in practice, so what attackers can actually do matters more than the headline rating.
Impact plus exposure equals blast radius
Microsoft frames risk as two questions: what does a successful exploit give the attacker, and where does that machine sit? A server running with an over-privileged service account or cloud identity can open paths to data and admin rights far beyond itself. Its advice is to fix first the takeover flaws on the most exposed, best-connected systems.
The layers that buy you time
- Know what faces the internet. Keep an up-to-date list of every system and appliance reachable from outside, including forgotten ones. External attack surface tools, such as Microsoft Defender External Attack Surface Management or comparable scanners, can help find them.
- Prioritize by exploitation, not just severity score. Put flaws known to be exploited, and takeover-class flaws on exposed servers, at the top. Vulnerability management tools that weigh threat intelligence, such as Microsoft Defender Vulnerability Management or similar products, make this easier.
- Shrink the server patch gap. Set a faster patch target for internet-facing servers and appliances than for desktops, and track it.
- Trim identities. Give service accounts and cloud identities only the permissions they need, so a compromised server does not hand over the keys to everything else.
- Map and break attack paths. Segment networks and review how an exposed system could reach your most important data. Attack path analysis features in tools like Microsoft Security Exposure Management, or a manual review, can show where to cut the route.
- Watch for what slips through. Endpoint detection and response on servers and workstations is the backstop when a patch has not landed yet.
What this means for your company
You do not need to patch every vulnerability the day it appears, but you do need to patch the right ones fast, starting with the servers and appliances that face the internet. The rest of your defenses should assume that sometimes an attacker will get there first: limited permissions, segmented networks and monitoring turn a successful exploit into a contained incident instead of a company-wide one.
Want a clear picture of which of your systems are exposed, how quickly they are patched, and how far an attacker could get from them? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
