> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Microsoft analysis shows RCE and privilege escalation dominate real-world exploitation
- URL: https://f4n6.co.uk/security-feed/microsoft-analysis-shows-rce-and-privilege-escalation-dominate-real-world-exploitation/
- Published: 2026-11-02T22:44:27.000Z
- Updated: 2026-11-02T22:44:27.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

Microsoft published a data-driven analysis of its tracked CVE catalog covering disclosures from 1999 through September 2026: of roughly 383,000 published vulnerabilities, only about 2,000 (roughly 0.5%) have been linked to real-world exploitation. Exploitation concentrates in takeover classes: server-side RCE rises from 20% of published CVEs to 37% of exploited ones, local privilege escalation from 11% to 18%, client-side RCE from 4% to 13%, and OS vulnerabilities from 23% to 41%, while XSS falls from 15% to 4% and denial of service from 16% to 7%. Takeover vulnerabilities (RCE, authentication bypass, local privilege escalation) account for 78% of real-world exploited vulnerabilities. The item names no CVE, no threat actor and no victim, so it carries no direct exposure for any client; its relevance to EMEA financial services is as a prioritisation argument, and the patching-lag figures it cites (more than a month median on Windows Servers, 10+ weeks on Linux Servers and MacOS applications, beyond a year on network appliances) describe exactly the estate most regulated firms run.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

## 3\. Technical analysis & attack chain

This is a statistical analysis of Microsoft's vulnerability catalog, not an incident report. There is no victim, no malware, no command-and-control and no attack chain to reconstruct. What follows is the mechanism the analysis describes and the numbers it rests on.

Microsoft classifies every CVE by the most consequential impact it directly enables, not by its underlying weakness type. A flaw that bypasses authentication and then enables RCE is counted as RCE. The twelve impact classes are server-side RCE (execution on a network-exposed service without user interaction), client-side RCE (execution requiring a user to open or run malicious content), local code execution (requiring local access or an existing foothold), local privilege escalation (elevation to SYSTEM or root), authentication or authorization bypass, security-control bypass (sandboxing, secure boot, SmartScreen), information disclosure, tampering or integrity, denial of service, XSS, arbitrary file access, and spoofing or redirect. Each CVE is counted once in the impact analysis and once per relevant platform (Windows, Linux/Unix, mobile, network appliances, IoT/OT, virtualization hosts, developer packages). Most CVEs affect application code (servers, web applications, browsers, productivity software, libraries, firmware tooling); a smaller share affects OS and system code (kernels, drivers, firmware).

The exploited subset looks different from the whole population. Fewer than 1 in 200 published CVEs are ever used in a real attack. The shift by impact class:

| Impact class               | Share of published CVEs | Share of exploited CVEs |
| -------------------------- | ----------------------- | ----------------------- |
| Server-side RCE            | 20%                     | 37%                     |
| Local privilege escalation | 11%                     | 18%                     |
| Client-side RCE            | 4%                      | 13%                     |
| OS vulnerabilities         | 23%                     | 41%                     |
| XSS                        | 15%                     | 4%                      |
| Denial of service          | 16%                     | 7%                      |

Takeover vulnerabilities (RCE, authentication bypass, local privilege escalation) account for 78% of real-world exploited vulnerabilities. Microsoft's stated reason is that RCE and privilege escalation create footholds that support later stages of an attack, while flaws that mainly cause a crash or limited script execution offer less utility for broader compromise. It also warns that a CVE's stated classification does not always match what an attacker can reliably achieve: some vulnerabilities described as enabling RCE result only in denial of service under real-world conditions.

The timing gap is the operationally useful part. Microsoft Security Exposure Management data from 2026 puts median patch time at about two weeks on Windows workstations, more than a month on Windows Servers, 10+ weeks on Linux Servers and for applications running on MacOS, and beyond a year on network appliances. Against that, exploitation is fast: Microsoft cites VulnCheck finding 29% of 2025 exploits launched within one day of CVE publication, and CISA data showing mean time from CVE publication to CISA KEV catalog entry fell from 89 days in 2024 to 57 days in 2025, with 2026 data to September at 20 days and a median of only 3 days since publication. Microsoft attributes part of the compression to AI-assisted exploit development, phrased as industry research suggesting AI is a significant factor. That causal claim is Microsoft's characterisation of third-party research, not a measurement in the item.

Microsoft's second axis is exposure: an asset's position in the environment and the identities, privileges and connections available from it. Servers often carry service accounts, application identities or cloud-managed identities with permissions beyond their operational need, so compromise of one system can yield access to additional resources, sensitive data, administrative privileges or trusted network paths. Impact multiplied by exposure gives the blast radius. Microsoft's recommended order is to fix takeover vulnerabilities first, then treat denial of service as severe only where the asset is availability-critical and credential or secret disclosure as severe because it feeds the same privileged-identity path.

A related source, Rapid7's Q3 2026 threat update, reports a different measurement on a different dataset and should not be read as corroboration of Microsoft's figures. Rapid7 tracked 43 newly exploited high- and critical-severity vulnerabilities in Q3 2026, down 7% from Q2 and up 19% year on year, with exploitation averaging three days after public disclosure, 71% within seven days, 80% within 14 days and 90% within 30 days; 34 of the 43 (79%) required no authentication or user interaction. The two sets agree on direction (fast exploitation of pre-auth, high-impact flaws) and disagree on method and population, so neither validates the other's numbers.

## 4\. Mitigation & containment

The item names no CVE, no affected product version and no vendor fix, so no patch identifier can be given here. The actions below follow from the prioritisation logic and the patch-lag figures Microsoft reports.

### P1 (within 24 hours)

- Rank the open vulnerability backlog by impact class rather than CVSS alone: pull every finding classed as server-side RCE, authentication or authorization bypass, or local privilege escalation on an internet-reachable asset to the top of the queue. Microsoft's data puts these three classes at 78% of exploited vulnerabilities.
- Identify which of those assets are reachable from the internet, including shadow IT and third-party dependencies, before scheduling the patch. A takeover flaw on an unreachable host and the same flaw on an exposed one are different risks.
- For any takeover-class finding on a network appliance, accept that the vendor patch may not arrive for a year or more by Microsoft's median, and put a compensating control (network segmentation, access restriction to known management ranges) in place now.

### P2 (within 72 hours)

- Map the identities each server-class asset can assume: service accounts, application identities, cloud-managed identities. Where those permissions exceed operational need, reduce them. Microsoft identifies over-privileged server identities as the mechanism that turns a single host compromise into environment-wide compromise.
- Build attack paths from internet-facing assets through privileged identities to critical data stores, and record where each path can be broken short of patching (network policy, credential scope, session controls).
- Where a CVE's stated class is RCE but the vendor or a credible source shows the real-world outcome is only denial of service, record that and deprioritise it accordingly; Microsoft explicitly warns the label overstates what an attacker can achieve in some cases.

### P3 (within 7 days)

- Measure your own median time-to-patch by platform and compare it with the figures in §3\. If Windows Servers sit above one month or Linux Servers above 10 weeks, the exposure window is wider than the median Microsoft reports and the remediation process, not the individual patch, is the problem.
- Set a separate, shorter remediation clock for takeover-class vulnerabilities on exposed assets than for the general backlog. Microsoft's cited CISA figure of a 3-day median from publication to KEV entry leaves no room for a monthly patch cycle on those classes.
- Treat credential and secret disclosure findings as privileged-identity issues rather than isolated low-severity events, per Microsoft's own framing.

## 5\. Indicators of compromise

No indicators of compromise available in the source material.

## 6\. Detection

Insufficient indicators to author detection rules.

## 7\. Sources

- Microsoft Security Blog, "What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks", https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/, 2026-11-02
- Rapid7 Blog, "Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days", https://www.rapid7.com/blog/post/tr-q3-2026-threat-update-attackers-exploiting-vulnerabilities-within-3-days (separate dataset; cited for context only, no date given in the supplied text)

## 8\. Adverse Trace position

Adverse Trace assesses this item as informational: it describes no vulnerability, campaign or breach, so there is no client-specific exposure to rate and no CVE severity to carry. The figures that matter for EMEA financial services are the patch-lag medians (more than a month on Windows Servers, 10+ weeks on Linux Servers and MacOS applications, beyond a year on network appliances) set against a 3-day median from CVE publication to CISA KEV entry in 2026 data; a firm whose server estate patches on a monthly cycle is exposed for most of the window in which exploitation happens. The AI-accelerated exploit development claim is Microsoft's characterisation of third-party research and is single-sourced to that blog; we do not treat it as established. We will re-run this prioritisation against client asset inventories on request, mapping takeover-class findings to internet-reachable hosts and the privileged identities behind them, and we will flag any future Microsoft or CISA publication that puts concrete CVE identifiers behind these percentages.

---

[Read the original source →](https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*