Threat reportThreat IntelligenceTL-2026-5146
Microsoft Analysis of 383,000 Vulnerabilities: Takeover Flaws Dominate Exploited CVEs
Microsoft analyzed roughly 383,000 CVEs published from 1999 through September 2026 and found 2,056 (about 0.5%) linked to real-world exploitation. Takeover vulnerabilities (RCE, authentication bypass, privilege escalation) make up 78% of exploited flaws, and server-side RCE is 20% of published CVEs but 37% of exploited ones.
Key facts for Microsoft exploited CVE analysis
| Identifiers | TL-2026-5146 |
|---|---|
| Severity | INFO |
| First disclosed | |
| Exploitation status | No known exploitation |
| MITRE ATT&CK techniques | T1190 Exploit Public-Facing Application, T1203 Exploitation for Client Execution, T1212 Exploitation for Credential Access |
| Motivation | UNKNOWN |
| Detection rules | 9 (1 shown free) |
| Sources | 5 cited sources |
Detection coverage for Microsoft exploited CVE analysis
As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5146 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: TL-2026-5146 Server-Side RCE: Web/App Server Spawning Shell (T1190)
Behaviour-first detection of server-side remote code execution (T1190): IIS, Apache, nginx, Tomcat or Java service processes spawning cmd, PowerShell, script hosts or download LOLBins. Server-side RCE is 20% of published CVEs but 37% of exploited CVEs per the Microsoft analysis tracked as TL-2026-5146.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1190, T1059
- Data sources: sysmon, windows_security
- Severity: high
- Confidence: high
Splunk SPL
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
```Server-side RCE (T1190): web or app server worker spawning an interpreter or LOLBin```
ParentImage IN ("*\\w3wp.exe", "*\\httpd.exe", "*\\nginx.exe", "*\\tomcat*.exe", "*\\java.exe")
Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\pwsh.exe", "*\\wscript.exe", "*\\cscript.exe", "*\\mshta.exe", "*\\certutil.exe", "*\\bitsadmin.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
| sort - countMicrosoft KQL
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "tomcat8.exe", "tomcat9.exe", "java.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLineSigma
title: Web or Application Server Spawning Shell or LOLBin (Server-Side RCE)
id: 3b1f6c2e-8a4d-4e57-9c0b-52d7a1e4f801
status: experimental
description: Detects a web or application server process spawning a command interpreter or download LOLBin, the typical outcome of server-side remote code execution (TL-2026-5146, T1190).
references:
- https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\w3wp.exe'
- '\httpd.exe'
- '\nginx.exe'
- '\java.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
condition: selection_parent and selection_child
falsepositives:
- Application health checks or deployment scripts launched by the web server
- Java build or management tooling that legitimately shells out
level: high
Known false positives:
- Application health-check or deployment scripts launched by the web server account
- Java-based management consoles that legitimately spawn cmd.exe
Tuning notes: Allowlist known parent/child/command-line combinations per application, and scope ParentImage to internet-facing servers. Raise severity when the child process makes an outbound network connection or the command line contains download/encoding flags.
- TL-2026-5146 Client-Side RCE: Office/PDF Reader Spawning Shell (T1203) · unlock with TL Creds
- TL-2026-5146 Credential Access: LSASS Dump Tooling (T1212/T1003.001) · unlock with TL Creds
- TL-2026-5146 Edge Device Exploitation: External Exploit Signature Fan-Out (T1190/T1210) · unlock with TL Creds
- TL-2026-5146 Exploit Follow-On: Web Server Writing Script File (T1190/T1505.003) · unlock with TL Creds
- TL-2026-5146 Security-Control Bypass: Defender Exclusions or Disable (T1211/T1562.001) · unlock with TL Creds
- TL-2026-5146 Exploit Instability: Repeated Crash of Exposed Service (T1499/T1190) · unlock with TL Creds
- TL-2026-5146 Local Privilege Escalation: SYSTEM Shell From User Parent (T1068) · unlock with TL Creds
- TL-2026-5146 Lateral Movement: Internal SMB/RPC/WinRM/RDP Fan-Out (T1210) · unlock with TL Creds
Indicators of compromise for Microsoft exploited CVE analysis
As of 2026-11-03, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5146.
How Microsoft exploited CVE analysis works
This is a trend and statistical research item, not a single campaign, CVE, actor or malware family. Microsoft published 'Exploited Vulnerabilities: Common Data-Driven Analysis of Real-World Attacks' on 2026-11-02, drawing on Microsoft's tracked vulnerability catalog, VulnCheck 2026 exploitation data, CISA KEV catalog metrics and Microsoft Security Exposure Management 2026 data. GBHackers covered it on 2026-11-03.
Key findings: about 383,000 CVEs were published from 1999 through September 2026, and about 2,056 (roughly 0.5%) are linked to exploitation in the wild. Takeover vulnerabilities (remote code execution, authentication bypass, privilege escalation) account for 78% of exploited flaws. Server-side RCE, defined as remote code execution on a network-exposed service without user interaction, is 20% of published CVEs but 37% of exploited CVEs. Operating-system and system-code flaws are 23% of the population but 41% of exploited flaws (applications are 77% of published and 59% of exploited). Local privilege escalation rises from 11% of published CVEs to 18% of exploited CVEs, and client-side RCE from 4% to 13%. Cross-site scripting falls from 15% to 4% and denial of service from 16% to 7%. The GBHackers coverage reports 1,239 exploited CVEs in remote-takeover classes.
Timing and remediation: Microsoft reports that the CISA KEV mean time from disclosure to KEV listing fell from 89 days (2024) to 57 days (2025) to 20 days (2026 through September), and that 29% of 2025 exploitation began within one day of CVE publication. Reported remediation times lag attackers: Windows workstations about 2 weeks, Windows servers over 1 month, Linux and macOS applications over 10 weeks, and network appliances over 1 year. VulnCheck's State of Exploitation 2026 (published 2026-01-21) independently found 884 vulnerabilities with first-time exploitation evidence in 2025, 28.96% of them exploited on or before the day the CVE was published, with network edge devices (firewalls, VPNs, proxies) the most targeted technology class.
Defensive relevance: the data supports prioritizing detection and patching for takeover-class flaws, focusing on exposed server infrastructure and high-privilege service accounts, reducing internet-facing attack surface, and using exposure scoring that goes beyond CVSS. No IOCs, actors or malware are named in the sources; the IOC list records the data sources and vulnerability classes as contextual indicators only.
MITRE ATT&CK techniques by tactic:
Initial Access
T1190 Exploit Public-Facing Application
Execution
T1203 Exploitation for Client Execution
Credential Access
Remediation for Microsoft exploited CVE analysis
Patches
- Apply vendor security updates for OS and system-code flaws first, since they are 23% of CVEs but 41% of exploited ones
Immediate actions
- Prioritize patching takeover-class vulnerabilities (server-side RCE, local privilege escalation, authentication/authorization bypass) on exposed assets
- Reduce the internet-facing attack surface so an unpatched flaw does not become an entry point
- Monitor CISA KEV and VulnCheck KEV for newly exploited CVEs affecting deployed products
Workarounds
- Where patching lags (for example network appliances), restrict management and service exposure and apply vendor mitigations
- Limit high-privilege service accounts on exposed server infrastructure
Longer-term hardening
- Use exposure scoring beyond CVSS that incorporates threat signals, breach likelihood and asset criticality
- Map attack paths across endpoints, cloud and hybrid environments
- Shorten patch SLAs for servers, Linux/macOS systems and network appliances, which lag workstations significantly
Timeline of Microsoft exploited CVE analysis
- Start of the CVE publication period (1999 onward) covered by locked-ioc-8's analysis of about 383,000 CVEs
- Full-year 2024 baseline: locked-ioc-10 KEV mean time from CVE disclosure to listing was 89 days, and locked-ioc-9 found 23.6% of first-time exploited KEVs were exploited on or before CVE publication
- Full-year 2025 data: locked-ioc-10 KEV mean time fell to 57 days; 29% of 2025 exploitation began within one day of CVE publication; locked-ioc-9 recorded 884 first-time exploited vulnerabilities (28.96% on or before publication)
- locked-ioc-9 publishes State of Exploitation 2026: 884 vulnerabilities with first-time exploitation evidence in 2025, 28.96% exploited on or before CVE publication
- Approximate cutoff of locked-ioc-8's analyzed dataset (CVEs published through September 2026); locked-ioc-10 KEV mean time to listing reached 20 days for 2026 through September
- locked-ioc-8 Security Blog publishes its analysis of about 383,000 CVEs, finding 2,056 (about 0.5%) linked to real-world exploitation and 78% takeover-class
- Item tracked on the Threadlinqs platform as trend context for prioritizing detection on takeover-class flaws
- GBHackers reports locked-ioc-8's findings, including server-side RCE at 20% of published but 37% of exploited CVEs
Sources cited for Microsoft exploited CVE analysis
- CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory
- Microsoft Security Blog: Exploited Vulnerabilities - Common Data-Driven Analysis of Real-World Attacks Microsoft · Vendor report · 2026-11-02
- VulnCheck: State of Exploitation 2026 vulncheck.com · Research · 2026-01-21
- VulnCheck 2026 State of Exploitation Report (PDF) wwv.vulncheck.com · Research · 2026-01-21
- Microsoft Analyzes 383,000 Security Vulnerabilities and Reveals Which Flaws Hackers Exploit Most gbhackers.com · News · 2026-11-03
Drafted by the Threadlinqs research pipeline from 5 sources; published ; last updated —.
