Microsoft Security Research analyzed approximately 383,000 disclosed software vulnerabilities from 1999 through September 2026. The study found that only about 2,000 CVEs have been linked to real-world exploitation, with a strong concentration in remote code execution and privilege escalation. Data indicates that the median time to patch vulnerabilities on Windows Servers exceeds one month, while 29% of 2025 exploits were launched within one day of publication. The report advises defenders to prioritize remediation of takeover vulnerabilities to reduce the potential blast radius of attacks.
Read the full story at microsoft.com.
Photo: Markus Spiske (CC0) via Openverse
