Only about 0.5% of all publicly disclosed software vulnerabilities have ever been used in a real attack, according to a large study published by Microsoft Security Research on 2 November 2026. The finding is a direct challenge to the habit of ranking patches by severity score alone.

The researchers, Yair Tsarfaty and Or Begam, analysed Microsoft's catalogue of tracked vulnerabilities, covering about 383,000 flaws disclosed from 1999 through September 2026. Of those, 2,056 were linked to real-world exploitation. The exact share is about 0.54%.

Takeover flaws dominate

Attackers are not picking flaws at random. Vulnerabilities that hand over control of a system, remote code execution, authentication bypass and local privilege escalation, account for 78% of the exploited set. Server-side remote code execution makes up 20% of all published vulnerabilities but 37% of the ones actually exploited. Operating system code accounts for 41% of exploited flaws, against 23% of the published total.

Cross-site scripting, by contrast, is common but rarely the route attackers use: it makes up 15% of published vulnerabilities but only 4% of exploited ones. The message for defenders is that exploitability and attacker value matter more than the raw count of flaws or the severity score attached to each one.

Exploitation is getting faster

The study also tracks how quickly exploitation follows disclosure. According to VulnCheck figures cited by Microsoft, 29% of exploits in 2025 were launched within one day of the relevant CVE being published. CISA data shows the average time from a CVE's publication to its entry in the Known Exploited Vulnerabilities catalogue fell from 89 days for flaws published in 2024 to 57 days in 2025, and to 20 days for flaws published in 2026 through September, with a median of only three days.

That speed leaves little room for slow patching cycles. The study notes that the median time to patch is about two weeks on Windows workstations but more than a month on Windows servers, and that for network appliances the median time to patch exceeds a year.

What this means for patching

Microsoft's conclusion is that vulnerability management should rank flaws by demonstrated attacker utility rather than by disclosure volume or CVSS score. A flaw with a high score that no attacker has ever used deserves less urgency than a lower-scored flaw in a class attackers repeatedly exploit, especially when it sits on a network-facing server.

One caveat is worth stating plainly: the blog post does not provide a downloadable dataset or a step-by-step description of how each CVE was classified, so the figures should be treated as Microsoft's own findings rather than an independently replicated study. Even with that limit, the pattern is consistent with what incident responders report: a small number of flaw types, used quickly, cause most of the damage.

[Source: Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/) | [Source: Cybersecurity News](https://cybersecuritynews.com/microsoft-reveals-78-of-exploited-vulnerabilities/)