Only 0.5% of 383,000 CVEs are ever exploited in real-world attacks

An analysis of CVEs disclosed through September 2026 finds that only 2,056 of roughly 383,000 - about 0.5% - have been linked to real-world attacks. It classifies vulnerabilities by the most consequential outcome they enable and by affected platform. The overall population is broad: about 77% affect applications and 23% operating systems. Exploited flaws look markedly different. Attackers favor vulnerabilities that enable control or access: server-side remote code execution accounts for 37% of exploited CVEs, compared with 20% of all CVEs; local privilege escalation rises from 11% to 18%, and client-side RCE from 4% to 13%. Operating-system flaws make up 41% of exploited vulnerabilities, versus 23% overall, while denial of service and cross-site scripting are less prominent. Takeover vulnerabilities together represent 78% of exploited CVEs.

The analysis argues that defenders should prioritize vulnerabilities according to both potential impact and the exposure of affected assets, since compromising a highly connected system with privileged identities can enable a much larger breach. Patching often takes weeks or months: median remediation is over a month for Windows servers, more than 10 weeks for Linux servers, and over a year for network appliances. Meanwhile, exploitation is accelerating: 29% of exploits in 2025 appeared within a day of disclosure, and by September 2026 the average time for a vulnerability to appear in CISA’s Known Exploited Vulnerabilities catalog had fallen to 20 days, with a median of three. The guidance is to address high-impact takeover flaws first, while considering denial-of-service risks especially carefully for availability-critical systems.