---
title: Microsoft: of about 383,000 CVEs since 1999, only 2,056 have been exploited, and 78% of those are remote code execution, auth bypass or privilege escalation. Servers stay unpatched longest | ctxsec
url: https://ctxsec.com/items/microsoft-exploited-vulnerabilities-analysis-2056-cves-78-percent-takeover
description: "Microsoft classified every CVE published through September 2026 by impact and platform. Exploited bugs skew heavily toward takeover: server-side RCE goes from 20% of all CVEs to 37% of exploited ones, local privilege escalation from 11% to 18% and client-side RCE from 4% to 13%, while XSS falls from 15% to 4%. OS code is 23% of CVEs but 41% of exploited ones. Its 2026 Exposure Management data puts median patch time at about two weeks on Windows workstations, over a month on Windows Server, 10+ weeks on Linux servers and macOS apps, and more than a year on network appliances."
status: "official (Microsoft Security blog, Nov 2)"
published: 2026-11-03
---

> Microsoft classified every CVE published through September 2026 by impact and platform. Exploited bugs skew heavily toward takeover: server-side RCE goes from 20% of all CVEs to 37% of exploited ones, local privilege escalation from 11% to 18% and client-side RCE from 4% to 13%, while XSS falls from 15% to 4%. OS code is 23% of CVEs but 41% of exploited ones. Its 2026 Exposure Management data puts median patch time at about two weeks on Windows workstations, over a month on Windows Server, 10+ weeks on Linux servers and macOS apps, and more than a year on network appliances.

[← Industry News](/industry) · [markdown](/items/microsoft-exploited-vulnerabilities-analysis-2056-cves-78-percent-takeover.md)

official (Microsoft Security blog, Nov 2)

2026-11-03

### Microsoft: of about 383,000 CVEs since 1999, only 2,056 have been exploited, and 78% of those are remote code execution, auth bypass or privilege escalation. Servers stay unpatched longest

- **Speed (Microsoft citing CISA data):** mean time from CVE publication to KEV listing fell from 89 days in 2024 to 57 in 2025 and 20 in 2026 so far, with a median of 3 days. Microsoft cites VulnCheck for 29% of 2025 exploits arriving within a day of publication.
- **Caveat:** a CVE's stated class doesn't always match what attackers can reliably do with it; some 'RCE' bugs only crash in practice.

**Practical read:** rank by exploitability and blast radius, not CVSS: takeover bugs on internet-facing servers and appliances first, since those are both the most targeted and the slowest to patch. Note the post ends with Microsoft product positioning.

Sources: [Microsoft Security: What exploited vulnerabilities have in common (Nov 2)](https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/)