Microsoft Reveals 78% of Exploited Vulnerabilities Enable System Takeover and Privilege Escalation

Microsoft’s new research shows that attackers pick flaws that give them control of a system. About 78% of vulnerabilities exploited in real attacks let an attacker take over a system or raise their privileges.

The finding comes from a data study published on November 2, 2026, by Microsoft Security Research. Software flaws keep piling up. From 1999 through September 2026, about 383,000 vulnerabilities were disclosed.

Only about 2,000 of them, roughly 0.5%, were linked to real-world exploitation. Fewer than 1 in 200 flaws ever reach a real attack, so defenders gain a lot by knowing which ones matter.

Microsoft researchers Yair Tsarfaty and Or Begam noted that attackers go after remote code execution, privilege escalation and authentication bypass bugs far more than other types.

The analysts also warned that AI-assisted bug hunting and exploit writing could shrink the time defenders have to react. That follows a trend already seen when attackers exploit flaws within hours of disclosure.

Microsoft Reveals 78% of Exploited Vulnerabilities

The team studied each CVE in two ways: by impact and by affected platform. Impact means the best result an attacker could get. For example, if a bug bypasses login and then allows remote code execution, Microsoft counts it as remote code execution.

Platforms included Windows, Linux and Unix, mobile, network appliances, IoT and OT, virtualization hosts, and developer packages.

The full CVE pool looks very different from the exploited pool. Across all published CVEs, about 77% sit in application code and 23% in operating system code.

Among exploited bugs, operating system flaws jump to 41%. Server-side remote code execution rises from 20% of all CVEs to 37% of exploited ones. Local privilege escalation climbs from 11% to 18%, and client-side remote code execution from 4% to 13%.

Low-value bug types fall sharply. Cross-site scripting drops from 15% to 4%, and denial of service from 16% to 7%.

Microsoft explained that a crash or a small script run gives an attacker little to build on, while code execution and higher privileges give a foothold for later steps.

A good example is the Windows privilege escalation flaw in the CLFS driver, which let local users reach SYSTEM access.

Microsoft also cautioned that a bug’s label does not always match real results. Some flaws described as remote code execution may only cause a crash in real conditions. So teams should check what an attacker can actually do before they rank a fix.

Why Slow Patching Helps Attackers

The second finding is about speed. Microsoft’s 2026 exposure data shows the median fix takes about two weeks on Windows workstations.

On Windows Servers it takes more than a month. Linux servers and macOS applications take over 10 weeks, and network appliances take more than a year. That gap is the window attackers use, and it is widest on the systems that matter most.

Exploitation moves much faster. VulnCheck reported that 29% of exploits in 2025 were launched within one day of CVE publication. CISA data shows the mean time from CVE publication to the KEV catalog fell from 89 days in 2024 to 57 days in 2025.

In 2026, through September, the mean is 20 days and the median is only 3 days. Microsoft says two things decide a flaw’s value to an attacker: impact and exposure. Servers often run service accounts or cloud identities with more permissions than they need.

Taking over one gives access to data, admin rights and trusted network paths. Microsoft calls this the blast radius. Public exploit code makes this worse, as seen when the MiniPlasma Windows zero-day gave SYSTEM access on patched machines.

Microsoft said defenders should fix takeover flaws first. Stopping them breaks an intrusion early, before it spreads. The second tier includes denial of service on systems where uptime is critical, and leaked credentials that feed privileged identity paths.

The same pattern shows in the Cloud Files driver zero-day, where attackers used a local flaw to gain SYSTEM rights. Patching is still key, but some old or unsupported systems cannot be patched.

Microsoft suggests finding all internet-facing assets, including shadow IT and third-party dependencies, with Defender External Attack Surface Management.

Defender Vulnerability Management then ranks weaknesses beyond CVSS scores, using exploit signals, internet exposure and asset value.

Attack Path Analysis shows how an exposed server could lead through a privileged identity to sensitive data, so teams can cut that route. Microsoft also shares more detail in its original research post.

Indicators of compromise (IoCs):-

Indicator Type	Value
SHA256 / MD5 / SHA1 hashes	None published in source
Domains / URLs	None published in source
IP addresses	None published in source
CVE IDs	None specific; analysis covers about 2,056 exploited CVEs

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.