The landscape of vulnerabilities is continually growing. Between 1999 and September 2026, around 383,000 software vulnerabilities have been revealed across various platforms and technologies; however, only about 2,000 CVEs (approximately 0.5%) have been associated with actual exploitation in the real world.
These vulnerabilities exhibit distinct patterns. Malicious actors tend to focus on weaknesses that facilitate system takeover, especially those involving remote code execution, privilege escalation, and authentication bypass. The use of AI in discovering vulnerabilities and developing exploits could further reduce the time available for defenders to react.
While patching is crucial, the remediation process can extend over weeks or months for critical systems, and certain legacy or unsupported systems may not be patchable. Consequently, defenders must prioritize their protective measures where they will be most effective, taking into account both the likelihood of exploitation and the potential impact of a successful attack.
Classifying the Vulnerability Landscape
To make this extensive population of vulnerabilities manageable, we evaluated each CVE based on two criteria: impact class and affected platform.
The impact class reflects the potential outcome a threat actor could achieve by exploiting a vulnerability. Each CVE is categorized according to the most significant impact it directly facilitates. For instance, if a vulnerability allows for authentication bypass and directly leads to remote code execution (RCE), it is classified as RCE. This method aids in differentiating the fundamental type of vulnerability from the security consequences an attacker could realize.
- Server-side RCE: Remote code execution on a service exposed to the network without user interaction.
- Client-side RCE: Remote code execution that necessitates user engagement with malicious content.
- Local code execution: Execution of code or commands requiring local access or an existing foothold.
- Local privilege escalation: Advancement from lower-level access to SYSTEM or root privileges.
- Authentication or authorization bypass: Evasion of authentication or access controls.
- Security-control bypass: Evasion of protections such as sandboxing, secure boot, or SmartScreen.
- Information disclosure: Unintentional exposure of sensitive data or secrets.
- Tampering or integrity: Unauthorized alteration of data or system state.
- Denial of service: Interruption of system or service availability.
- Cross-site scripting (XSS): Script execution within the context of a victim’s browser.
- Arbitrary file access: Unauthorized access to or placement of files.
- Spoofing or redirect: Deception through spoofing, redirection, or other UI manipulation.
We also categorized vulnerabilities based on the platforms they impact, which include Windows, Linux/Unix, mobile devices, network appliances, IoT/OT, virtualization hosts, and developer packages. A CVE may affect multiple platforms. Developer packages are considered a distinct category due to their cross-platform nature and their significant representation within the overall vulnerability population.
The majority of CVEs analyzed pertain to application code, encompassing servers, web applications, browsers, productivity software, libraries, and firmware tools, while a smaller proportion relates to operating system and system code, such as kernels, drivers, and firmware.
This analysis encompasses CVEs published up to September 2026, utilizing Microsoft’s catalog of tracked vulnerabilities. Each CVE is counted once in the impact analysis and across each applicable platform in the platform analysis.
Vulnerabilities Exploited in the Wild
The segment of vulnerabilities that are exploited in real-world scenarios is significantly smaller than the total CVE population and presents a markedly different profile. Fewer than 1 in 200 published CVEs are ever utilized in an actual attack, and those that are exploited are predominantly found within the takeover categories that maximize the impact and exposure for threat actors.
The disparity becomes evident when examining impact. Exploitation is heavily skewed towards vulnerabilities that grant attackers increased control over a system. The proportion of server-side RCE vulnerabilities rises from 20% of published CVEs to 37% of those exploited.
Source: Original article
