Hackers Exploit Flaws in Days. Businesses Take Over a Year to Patch Them.

Key points

• Microsoft's analysis of roughly 383,000 software flaws disclosed between 1999 and September 2026 found that only a small fraction have been used in real attacks.
• Patching a vulnerability on a network appliance, the hardware boxes that route and secure company traffic, takes a median of more than one full year.
• Mean time from a flaw being publicly named to criminals actively using it fell from 89 days in 2024 to 57 days in 2025, then to just 20 days through September 2026, with a median of three days.
• Remote code execution flaws, which let an outsider run commands on a machine they don't own, make up 20% of all known vulnerabilities but 37% of those actually exploited.
• Remote code execution, authentication bypass (tricking a system into skipping its login checks), and local privilege escalation (gaining admin powers on a machine already accessed) account for 78% of real-world attacks.

Software has bugs. That has always been true. What Microsoft's security research team published on 2 November 2026 is a precise measure of how badly the timing mismatch between attackers and defenders has become, and which categories of flaw are doing most of the damage.

The short version: criminals are moving faster every year, and the systems companies rely on most are being patched the slowest.

How fast are criminals actually moving?

Very fast, and getting faster. Mean time from a flaw being publicly catalogued to it appearing in CISA's Known Exploited Vulnerabilities list, the US government's running record of bugs criminals are actively using, dropped from 89 days in 2024 to 57 days in 2025. Through September 2026 that figure had fallen to 20 days on average, with a median of just three.

Separate industry research cited by Microsoft found that 29% of exploits in 2025 were launched within a single day of a flaw being named publicly. Microsoft's researchers also flag AI-assisted exploit development as a factor shortening that window, because automated tools can analyse a patch or a vulnerability description and generate working attack code far faster than a human team could manage alone. Our coverage of the Palo Alto PAN-OS code injection bug on 15 October showed exactly that dynamic: federal agencies had three days to act on a flaw already being exploited in the wild.

Why does patching take so long?

For most organisations, fixing a flaw isn't as simple as clicking update. Network appliances, the physical or virtual boxes that control how traffic flows in and out of a company's systems, take a median of more than a year to patch. Windows servers take more than a month. Linux servers and macOS applications take over ten weeks. Windows workstations, the ordinary desktop computers most employees use, fare best at roughly two weeks.

Firmware updates on appliances can knock critical services offline. Change approvals, application dependencies, and maintenance windows all add delay. Researcher Vibhum Dubey, quoted in the original CSO Online report, put it plainly: "Network appliances are particularly difficult because firmware upgrades can affect critical business operations." The result is a gap that favours whoever is attacking.

Which flaws do attackers actually go after?

Not the ones that score highest on automated severity ratings. Remote code execution flaws are over-represented in real attacks by nearly double their share of the overall vulnerability population. Authentication bypass and privilege escalation follow the same pattern.

Cross-site scripting flaws, which let attackers inject code into web pages, drop from 15% of all known vulnerabilities to just 4% of exploited ones. Denial-of-service bugs fall from 16% to 7%. Criminals prioritise flaws that give them control, not just disruption. Operating system vulnerabilities show the starkest gap: 23% of the total population but 41% of exploited cases.

Should ordinary people do anything?

If you use software at work or at home, the practical answer is straightforward: accept updates when they arrive and don't delay them. Organisations running older network hardware or servers carry the biggest risk, because those are the systems where updates get deprioritised over disruption concerns.

For businesses, a flat patch schedule built around monthly cycles isn't adequate anymore. A medium-severity flaw on an internet-facing machine with a known exploit in circulation can cause more real damage than a theoretically critical flaw sitting on an isolated internal system. CVSS scores, the standard 1-to-10 severity ratings attached to most vulnerabilities, don't capture that distinction on their own.

What this data actually tells you: the flaws that get weaponised are not random. They're predictable categories, hitting predictable system types, on a timeline that's compressed dramatically. Defenders still treating patching as a scheduling problem are solving the wrong question.