Microsoft: only about 0.5% of 383,000 CVEs linked to real attack exploitation
What happened
Microsoft analyzed roughly 383,000 CVEs disclosed between 1999 and September 2026 and found only about 2,000, around 0.5%, tied to real-world exploitation, Hacker News reported on November 3. Exploited flaws cluster in system takeover: server-side RCE rose from 20% to 37%, local privilege escalation from 11% to 18%, and client-side RCE from 4% to 13%. XSS fell from 15% to 4% and denial of service from 16% to 7%.
Written by AI from the coverage · updated 1 hour ago
Coverage
Follow the reports to see the story from different sides.
- Hacker News front pageOnly 0.5% of 383,000 CVEs are ever exploited in real-world attacks
微软分析 1999 年至 2026 年 9 月披露的约 383,000 个 CVE，发现仅约 2,000 个（约 0.5%）被关联到真实攻击利用。被利用漏洞高度集中于系统接管类：服务端 RCE 占比从 20% 升至 37%，本地提权从 11% 升至 18%，客户端 RCE 从 4% 升至 13%，而 XSS 从 15% 降至 4%、拒绝服务从 16% 降至 7%。
Heat over time
Not enough continuous observations to draw a trend yet.