Threat Intelligence

Only 0.5% of Known Software Flaws Are Exploited, and They Share Clear Patterns

Microsoft Security · 3 Nov 2026

Key Takeaway Prioritise patching and extra protection for flaws that allow remote code execution, privilege escalation or authentication bypass, especially on internet-facing and unsupported systems.

Microsoft's Security team has published a data-driven look at which software flaws attackers actually use. From 1999 through September 2026, about 383,000 vulnerabilities were disclosed across platforms and technologies. Only about 2,000 of them (roughly 0.5%) have been linked to real-world exploitation.

The exploited flaws follow clear patterns. Attackers disproportionately target vulnerabilities that enable system takeover, particularly remote code execution, privilege escalation and authentication bypass. Microsoft also warns that AI-assisted vulnerability discovery and exploit development could further shorten the time defenders have to respond. Patching remains essential, but fixes on critical systems can take weeks or months, and some legacy or unsupported systems cannot be patched at all. Defenders therefore need to focus protection where it matters most, weighing both the likelihood of exploitation and the potential damage of a successful attack.

To make the data usable, Microsoft classified each vulnerability by impact class (the most serious outcome it directly enables) and by affected platform. Platforms include Windows, Linux/Unix, mobile, network appliances, IoT/OT, virtualisation hosts and developer packages. Most of the vulnerabilities affect application code such as servers, web applications, browsers and productivity software, while a smaller share affects operating system code such as kernels, drivers and firmware.

Summarised by CISO AI from Microsoft Security, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.