Microsoft Security Research published a short, numbers-heavy analysis on 2 November 2026 of which vulnerabilities attackers actually use. The headline figure: from 1999 through September 2026 roughly 383,000 vulnerabilities were disclosed, and only about 2,000 CVEs (around 0.5%) have been linked to real-world exploitation. The exploited set is 2,056 CVEs in their data. Fewer than 1 in 200 published CVEs ever gets used in an attack.

This post goes through what the report says, what I think follows from it, and where the numbers need care. Everything quoted below comes from the Microsoft Security blog post , which I read in full.

The exploited set is not a sample of the whole

The authors classified each CVE by impact class and platform, then compared the full population against the exploited subset.…