Microsoft: of about 383,000 CVEs since 1999, only 2,056 have been exploited, and 78% of those are remote code execution, auth bypass or privilege escalation. Servers stay unpatched longest
- Speed (Microsoft citing CISA data): mean time from CVE publication to KEV listing fell from 89 days in 2024 to 57 in 2025 and 20 in 2026 so far, with a median of 3 days. Microsoft cites VulnCheck for 29% of 2025 exploits arriving within a day of publication.
- Caveat: a CVE's stated class doesn't always match what attackers can reliably do with it; some 'RCE' bugs only crash in practice.
Practical read: rank by exploitability and blast radius, not CVSS: takeover bugs on internet-facing servers and appliances first, since those are both the most targeted and the slowest to patch. Note the post ends with Microsoft product positioning.
Sources: Microsoft Security: What exploited vulnerabilities have in common (Nov 2)