The Tiny Slice of CVEs That Actually Gets Used in the Wild

Security teams are trained to fear volume. Thousands of new CVEs arrive, each with a score, a label, and a fresh reminder that patching never ends. But the more useful question is not how many flaws exist. It is which ones attackers actually turn into leverage. Microsoft’s analysis suggests the answer is a very small subset, and that subset is concentrated in flaws that can deliver real control of a system.

Fast Facts

• Microsoft reportedly analyzed 382,789 CVEs disclosed from 1999 through September 2026.
• About 2,056 CVEs were identified as linked to real-world exploitation, or roughly 0.5% of the dataset.
• The exploited set is said to skew toward takeover-capable outcomes, including server-side RCE, local privilege escalation, and client-side RCE.
• The analysis supports prioritizing evidence of exploitation alongside severity, not replacing one signal with the other.
• The figures are historical observations from a defined dataset, not a guarantee that unexploited CVEs are harmless.

Why the exploited minority matters

The technical lesson is less dramatic than it sounds, but more important: disclosed vulnerabilities are not equal in operational value to an attacker. Microsoft’s dataset groups each CVE by the most consequential impact it directly enables, and the exploited population clusters heavily around paths that can lead to code execution or higher privilege. That matters because a flaw that can run code on a server, or elevate a foothold into full control, can become a pivot point inside an organization.

That does not mean every vulnerable system is equally exposed, or that every takeover-capable bug will be abused. It does mean defenders should stop treating disclosure count as a proxy for danger. A long patch queue is not automatically a list of urgent incidents. The real question is whether the vulnerable product is deployed, reachable, high value, and already within an attacker’s practical reach.

What this changes for defenders

From a defensive perspective, the right triage model combines several signals. Known exploitation evidence should rise to the top. Predictive scores can help with forward-looking risk, but they are not the same as confirmed abuse. Severity still matters, yet it does not capture whether a flaw is reachable in your environment, whether compensating controls exist, or whether the affected asset has privileged access to something more valuable.

That is why asset inventory is the real multiplier. If teams cannot map CVEs to actual products, versions, and exposed services, they are forced to prioritize from a global list instead of a local risk picture. In practice, the strongest remediation candidates are the vulnerabilities that combine demonstrated exploitation, internet exposure, and meaningful downstream impact.

Conclusion

The broader lesson is simple: vulnerability management is not a contest to patch everything at once. It is an exercise in distinguishing theoretical danger from proven attacker utility. Microsoft’s numbers reinforce a disciplined approach - treat exploitation evidence as a first-class input, then decide what matters most in your own environment.

WIKICROOK

• CVE: A public identifier for a disclosed vulnerability, used to track and compare security issues.
• Remote Code Execution (RCE): A flaw that can let an attacker run code on a target system.
• Privilege Escalation: A weakness that may let a user or attacker gain higher permissions than intended.
• KEV: CISA’s Known Exploited Vulnerabilities catalog, which tracks flaws with evidence of active exploitation.
• EPSS: A predictive model that estimates the likelihood a CVE will be exploited within a short time window.