# Microsoft Analysis of 383,000 Vulnerabilities: Takeover Flaws Dominate Exploited CVEs

> Microsoft analyzed roughly 383,000 CVEs published from 1999 through September 2026 and found 2,056 (about 0.5%) linked to real-world exploitation. Takeover vulnerabilities (RCE, authentication bypass, privilege escalation) make up 78% of exploited flaws, and server-side RCE is 20% of published CVEs but 37% of exploited ones.

- **Published:** 2026-11-03T11:37:59Z
- **Last reviewed:** 2026-11-03T11:37:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5146
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5146.png
- **ID:** TL-2026-5146
- **Severity:** INFO
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 10

## Description

This is a trend and statistical research item, not a single campaign, CVE, actor or malware family. Microsoft published 'Exploited Vulnerabilities: Common Data-Driven Analysis of Real-World Attacks' on 2026-11-02, drawing on Microsoft's tracked vulnerability catalog, VulnCheck 2026 exploitation data, CISA KEV catalog metrics and Microsoft Security Exposure Management 2026 data. GBHackers covered it on 2026-11-03.

Key findings: about 383,000 CVEs were published from 1999 through September 2026, and about 2,056 (roughly 0.5%) are linked to exploitation in the wild. Takeover vulnerabilities (remote code execution, authentication bypass, privilege escalation) account for 78% of exploited flaws. Server-side RCE, defined as remote code execution on a network-exposed service without user interaction, is 20% of published CVEs but 37% of exploited CVEs. Operating-system and system-code flaws are 23% of the population but 41% of exploited flaws (applications are 77% of published and 59% of exploited). Local privilege escalation rises from 11% of published CVEs to 18% of exploited CVEs, and client-side RCE from 4% to 13%. Cross-site scripting falls from 15% to 4% and denial of service from 16% to 7%. The GBHackers coverage reports 1,239 exploited CVEs in remote-takeover classes.

Timing and remediation: Microsoft reports that the CISA KEV mean time from disclosure to KEV listing fell from 89 days (2024) to 57 days (2025) to 20 days (2026 through September), and that 29% of 2025 exploitation began within one day of CVE publication. Reported remediation times lag attackers: Windows workstations about 2 weeks, Windows servers over 1 month, Linux and macOS applications over 10 weeks, and network appliances over 1 year. VulnCheck's State of Exploitation 2026 (published 2026-01-21) independently found 884 vulnerabilities with first-time exploitation evidence in 2025, 28.96% of them exploited on or before the day the CVE was published, with network edge devices (firewalls, VPNs, proxies) the most targeted technology class.

Defensive relevance: the data supports prioritizing detection and patching for takeover-class flaws, focusing on exposed server infrastructure and high-privilege service accounts, reducing internet-facing attack surface, and using exposure scoring that goes beyond CVSS. No IOCs, actors or malware are named in the sources; the IOC list records the data sources and vulnerability classes as contextual indicators only.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1212 Exploitation for Credential Access

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5146 Server-Side RCE: Web/App Server Spawning Shell (T1190)** (`TL-2026-5146-SPL-001`)

Behaviour-first detection of server-side remote code execution (T1190): IIS, Apache, nginx, Tomcat or Java service processes spawning cmd, PowerShell, script hosts or download LOLBins. Server-side RCE is 20% of published CVEs but 37% of exploited CVEs per the Microsoft analysis tracked as TL-2026-5146.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
```Server-side RCE (T1190): web or app server worker spawning an interpreter or LOLBin```
ParentImage IN ("*\\w3wp.exe", "*\\httpd.exe", "*\\nginx.exe", "*\\tomcat*.exe", "*\\java.exe")
Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\pwsh.exe", "*\\wscript.exe", "*\\cscript.exe", "*\\mshta.exe", "*\\certutil.exe", "*\\bitsadmin.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
| sort - count
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "tomcat8.exe", "tomcat9.exe", "java.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: Web or Application Server Spawning Shell or LOLBin (Server-Side RCE)
id: 3b1f6c2e-8a4d-4e57-9c0b-52d7a1e4f801
status: experimental
description: Detects a web or application server process spawning a command interpreter or download LOLBin, the typical outcome of server-side remote code execution (TL-2026-5146, T1190).
references:
    - https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '\java.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Application health checks or deployment scripts launched by the web server
    - Java build or management tooling that legitimately shells out
level: high

```

**Known false positives:**

- Application health-check or deployment scripts launched by the web server account
- Java-based management consoles that legitimately spawn cmd.exe

**Tuning notes:** Allowlist known parent/child/command-line combinations per application, and scope ParentImage to internet-facing servers. Raise severity when the child process makes an outbound network connection or the command line contains download/encoding flags.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5146 Client-Side RCE: Office/PDF Reader Spawning Shell (T1203) (locked: unlock with TL Creds)
- TL-2026-5146 Credential Access: LSASS Dump Tooling (T1212/T1003.001) (locked: unlock with TL Creds)
- TL-2026-5146 Edge Device Exploitation: External Exploit Signature Fan-Out (T1190/T1210) (locked: unlock with TL Creds)
- TL-2026-5146 Exploit Follow-On: Web Server Writing Script File (T1190/T1505.003) (locked: unlock with TL Creds)
- TL-2026-5146 Security-Control Bypass: Defender Exclusions or Disable (T1211/T1562.001) (locked: unlock with TL Creds)
- TL-2026-5146 Exploit Instability: Repeated Crash of Exposed Service (T1499/T1190) (locked: unlock with TL Creds)
- TL-2026-5146 Local Privilege Escalation: SYSTEM Shell From User Parent (T1068) (locked: unlock with TL Creds)
- TL-2026-5146 Lateral Movement: Internal SMB/RPC/WinRM/RDP Fan-Out (T1210) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Microsoft Security Blog: Exploited Vulnerabilities - Common Data-Driven Analysis of Real-World Attacks](https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/)
- [Microsoft Analyzes 383,000 Security Vulnerabilities and Reveals Which Flaws Hackers Exploit Most](https://gbhackers.com/383000-vulnerabilities-analyzed/)
- [VulnCheck: State of Exploitation 2026](https://www.vulncheck.com/blog/state-of-exploitation-2026)
- [VulnCheck 2026 State of Exploitation Report (PDF)](https://wwv.vulncheck.com/hubfs/Research/2026-StateofExploitation.pdf?hsLang=en)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5146