The median vulnerability on enterprise network appliances stays unpatched for more than a year, Microsoft’s own telemetry shows, even as the most damaging software flaws are being weaponized within days of disclosure.
Microsoft Security Research reported the findings Monday in an analysis of roughly 383,000 CVEs disclosed from 1999 through September 2026. It shows that the median time to patch a vulnerability exceeds a year for network appliances. The period is more than a month for Windows servers, over 10 weeks for Linux servers and applications running on macOS, and about two weeks for Windows workstations.
“That gap is the threat actor’s window, widest on the critical systems that stay exposed the longest,” Microsoft Security researchers Yair Tsarfaty and Or Begam wrote in a blog post detailing the findings. They were referring to the distance between how fast flaws are exploited and how slowly critical systems are patched.
Patching measured in weeks and months
Microsoft drew its patching figures from 2026 data in its Security Exposure Management product. The median vulnerability is fixed in about two weeks on Windows workstations but takes more than a month on Windows Server, according to the post. The delay stretches beyond 10 weeks on Linux servers and for applications running on macOS, and past a year on network appliances.
Vibhum Dubey, a cybersecurity researcher and red teamer, said the findings reflect what he sees across enterprise environments. In those environments, change approvals, application dependencies, maintenance windows, and legacy infrastructure routinely hold up fixes.
“Network appliances are particularly difficult because firmware upgrades can affect critical business operations,” Dubey said. “In many cases, the challenge is not identifying vulnerabilities, but getting the right teams to remediate them without disrupting business services.”
Exploitation measured in days
Exploitation runs on a far shorter clock, Microsoft wrote in the post. Citing CISA figures, the researchers said the mean time from CVE publication to listing in CISA’s Known Exploited Vulnerabilities catalog fell from 89 days in 2024 to 57 days in 2025. For 2026 through September, the mean has dropped to 20 days and the median to three.
“Exploitation runs on the opposite clock: the most impactful vulnerabilities are weaponized in days, increasingly on or before disclosure,” the post said.
The researchers also cited VulnCheck’s State of Exploitation 2026 report, which found that 29% of exploits in 2025 were launched within a day of CVE publication. Industry research points to advances in AI as a significant factor in cutting the time needed to develop exploits, Microsoft wrote in the blog post.
In some cases, defenders have hours rather than weeks, Dubey said. Vulnerabilities can be exploited before public disclosure or before organizations have completed their initial assessment.
He said enterprises need to move away from relying entirely on monthly scans and scheduled patch cycles. In their place, he said, they need continuous monitoring, emergency patching procedures, virtual patching through WAF and IPS controls, and clear remediation ownership.
“The priority should be to reduce the window of exposure, because by the time a vulnerability reaches the regular patching queue, attackers may already be exploiting it,” Dubey said.
Where the exploits land
The vulnerabilities attackers actually use look very different from the CVE population as a whole, the analysis found. Server-side remote code execution (RCE) flaws make up 20% of all published CVEs but 37% of those exploited in the wild. Local privilege escalation climbs from 11% to 18%, and client-side RCE from 4% to 13%.
Cross-site scripting drops from 15% of published CVEs to 4% of exploited ones, and denial-of-service flaws drop from 16% to 7%, according to the researchers. Operating system vulnerabilities make up 23% of the overall population but account for 41% of exploited CVEs.
“These patterns are consistent with threat actors favoring vulnerabilities that can provide meaningful access and control,” the researchers wrote.
Together, RCE, authentication bypass, and local privilege escalation account for 78% of real-world exploited vulnerabilities, the post said. Windows ranks as the most affected platform among exploited CVEs in Microsoft’s data.
Prioritizing by exposure
A vulnerability’s value to an attacker depends on its impact and its exposure, according to Microsoft. Impact is what successful exploitation delivers. Exposure is the identities, privileges, and network connections reachable from the compromised asset.
Servers frequently run service accounts, application identities, or cloud-managed identities with more permissions than they need, the post noted. Taking over one of them can open paths to sensitive data, administrative rights, and trusted networks.
“CVSS scores alone are no longer sufficient,” Dubey said. Organizations should prioritize vulnerabilities based on active exploitation, internet exposure, asset criticality, and potential attack paths, he said. “A medium-severity vulnerability on an internet-facing system with a known exploit can present a greater risk than a critical vulnerability on an isolated asset,” he said.
No Responses