Data Analysis Reveals Why Most Vulnerabilities Remain Unexploited
In short: Microsoft's analysis of 383,000 vulnerabilities since 1999 confirms that less than 0.5% are exploited in the wild. Attackers overwhelmingly favor 'takeover' vulnerabilities, such as Remote Code Execution (RCE) and privilege escalation, while AI-assisted exploit development has significantly reduced the time between disclosure and weaponization.
This summary was generated automatically by AI from Microsoft Security's publication. It is our own text, not a copy of the original — facts, figures and quotes belong to the source, linked above and below.
What changed?
- 1Mean time from CVE publication to CISA KEV listing dropped from 89 days in 2024 to 3 days in 2026.
- 229% of 2025 exploits were launched within one day of disclosure.
- 378% of real-world exploited vulnerabilities are classified as takeover-type (RCE, Auth bypass, PrivEsc).
- 4Patching gaps persist: servers take over a month to patch, whereas exploit development now occurs in days.
Why it matters
Security teams should stop treating all vulnerabilities as equal. Because attackers aggressively weaponize RCEs using AI, patching must prioritize internet-facing infrastructure and high-impact takeover flaws rather than just following generic CVSS scores.
What it means for AI agents and contact centers
When maintaining voice AI infrastructure (Asterisk/SIP servers), prioritize patching internet-exposed services immediately. Monitor for RCE vulnerabilities specifically, as these are the primary targets for attackers trying to gain an initial foothold. Treat AI-assisted automated exploits as an imminent threat to your deployment environment.
Sources
- Microsoft SecurityOfficialPrimary sourceOriginal article →„What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks“2 Nov 2026, 22:20
- Published by source
- 2 Nov 2026, 22:20
- Found by our system
- 2 Nov 2026, 23:58
- Summary generated
- 2 Nov 2026, 23:59
This article was written by AI from the original source. Facts, numbers and prices come from the source; missing values are marked “Not specified”. Legal notice, copyright and privacy