Attackers exploit just 0.5% of disclosed vulnerabilities, but they know which ones to pick
Hackers want control.
Getty Images For Unsplash.
Follow us
- Microsoft says only about 2,000 of nearly 383,000 disclosed vulnerabilities have been used in real attacks.
- Attackers favor flaws that let them take over systems, increase access, or run commands remotely.
- Bugs that mainly crash apps or affect websites account for a smaller share of real-world attacks.
- Microsoft says teams should fix the most dangerous flaws quickly, because attackers can weaponize them within days.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Of the nearly 383,000 software vulnerabilities disclosed since 1999, only around 2,000 have been linked to real-world attacks, according to Microsoft. But attackers aren't picking those flaws at random. They overwhelmingly favor vulnerabilities that let them take control of systems, escalate privileges, and expand their access.
Check if your data was exposed
Find out if your email and related personal information have appeared in known data breaches.
The researchers found that attackers overwhelmingly favor vulnerabilities that offer a route to system takeover. Server-side remote code execution (RCE), for instance, accounts for 37% of exploited vulnerabilities, compared with just 20% of all disclosed CVEs.
Similarly, local privilege escalation vulnerabilities feature prominently, accounting for 18% of exploited flaws, compared with 11% of all disclosed vulnerabilities. Client-side RCE makes up another 13%, compared with just 4% of the overall vulnerability pool.
However, the pattern reverses for vulnerabilities that offer less control. Cross-site scripting (XSS), which accounts for 15% of all disclosed vulnerabilities, represents only 4% of those exploited in real-world attacks. Denial-of-service flaws also fall from 16% of all disclosures to just 7% of exploited vulnerabilities.
Microsoft says these differences reflect what attackers hope to achieve after breaking into a system. A vulnerability that lets hackers execute commands, bypass authentication, or obtain administrator-level privileges can give them a foothold for further attacks. A flaw that merely crashes an app offers far fewer opportunities.
"Threat actors do not exploit at random," the researchers wrote. Instead, they target vulnerabilities that offer the greatest impact and exposure, particularly those that grant them control over systems and access to privileged identities and critical assets.
The patch race is getting tighter
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
The findings come as security teams face an increasingly uncomfortable gap between discovering vulnerabilities and deploying fixes. Microsoft says attackers can weaponize the most impactful flaws within days of disclosure, sometimes even before vendors release patches.
Its own data shows that Windows workstations take a median of around two weeks to patch vulnerabilities, while Windows servers take more than a month. Linux servers and macOS applications can take over 10 weeks to patch, while network appliances can remain unpatched for more than a year.
Recent reports have highlighted just how quickly attackers can turn newly disclosed flaws into working exploits. VulnCheck recently found that 23.4% of vulnerabilities were exploited within 24 hours of their CVE publication. The median time between disclosure and exploitation also fell from 120 days to 80 days.
Individual attacks illustrate the problem. In August, attackers began exploiting a critical GitLab vulnerability barely 24 hours after its disclosure. Another campaign saw at least four Chinese state-aligned hacking groups exploit Chrome and Windows vulnerabilities before affected users received patches.
With attackers increasingly targeting the weaknesses that offer the greatest payoff, Microsoft's central message is that fixing the right vulnerabilities quickly could matter more than simply fixing more of them.
