Hackers are focusing on a select few known software vulnerabilities, targeting weaknesses that allow them to gain control over systems rather than just disrupting services. A Microsoft analysis reveals that 2,056 vulnerabilities have been linked to actual attacks, representing approximately 0.5% of approximately 383,000 CVEs covered up to September 2026. Remote code execution, privilege escalation, and authentication bypass are particularly valuable entry points into enterprise environments, especially when affected systems possess powerful identities or connect to sensitive resources.
The total number of CVEs as of September 2026, categorized by impact class and affected platforms, and split by operating system and application. These distinctions indicate that attackers favor vulnerabilities that establish footholds, grant additional privileges, or facilitate further compromise. A vulnerability labeled as remote code execution may only cause a crash under real-world conditions, making demonstrated capability essential for prioritizing remediation efforts.
The analysis reveals median patching times of approximately two weeks for Windows workstations, more than a month for Windows servers, and over ten weeks for Linux servers. A compromised server with privileged service accounts or trusted cloud connections can lead to broader compromises, as Microsoft noted. Microsoft Defender's External Attack Surface Management helps identify internet-facing infrastructure, including unknown or unmonitored assets and third-party dependencies.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and minimize manual effort.
