Microsoft tomonidan e'lon qilingan taxminan 383 000 ta zaiflik tahlili shuni ko'rsatadiki, hujumchilar tizimni egallab olishga imkon beradigan zaifliklarni afzal ko'rishadi, zaifliklardan tasodifiy foydalanish o'rniga.
Tadqiqot real dunyoda foydalanilgan 2 056 ta CVE ni aniqladi — bu umumiy sonning taxminan 0,5 foizini tashkil etadi. Bu zaifliklarni boshqarishda e'lon qilingan son yoki faqat jiddiylik ballariga emas, balki hujumchilarning amaliy foydasiga ustuvorlik berish zarurligini ta'kidlaydi.
1999 yildan 2026-yil sentyabrigacha e'lon qilingan zaifliklarni qamrab olgan Microsoft katalogiga asoslangan baholash zaifliklarni ularning eng jiddiy to'g'ridan-to'g'ri ta'siri va ta'sirlangan platformalar bo'yicha tasniflaydi.
Asosiy xulosa shuki, tizimni egallab olish zaifliklari — jumladan masofaviy kod bajarish, autentifikatsiyani chetlab o'tish va mahalliy imtiyozlarni oshirish — foydalanilgan zaifliklarning 78 foizini tashkil etadi.
Bu zaifliklar tarmoq orqali ochiq xizmatlarni foydalanuvchi bilan o'zaro aloqasiz buzishi mumkin, bu esa ularni qimmatli kirish nuqtalariga aylantiradi.
Mahalliy imtiyozlarni oshirish e'lon qilingan zaifliklar orasida 11 foizdan foydalanilgan zaifliklar orasida 18 foizgacha ko'tariladi, bu hujumchilarga cheklangan kirish nuqtalarini imtiyozli kirishga aylantirishga yordam beradi.
Mijoz tomonidagi masofaviy kod bajarish yanada keskin nisbatda o'sadi — e'lon qilingan CVE lar orasida 4 foizdan foydalanilgan zaifliklar orasida 13 foizgacha.
Server tomonidagi foydalanishdan farqli o'laroq, bu hujumlar jabrlanuvchilardan zararli kontentni ochish yoki bajarishni talab qiladi. Aksincha, saytlararo skriptlash (XSS) 15 foizdan 4 foizgacha, xizmatni rad etish (DoS) zaifliklari esa 16 foizdan 7 foizgacha pasayadi.
Microsoft tadqiqotchilari aytishicha, server tomonidagi masofaviy kod bajarish e'lon qilingan zaifliklarning 20 foizini, ammo foydalanilgan CVE larning 37 foizini tashkil etadi.
383 000 ta zaiflik tahlil qilindi
Operatsion tizim zaifliklari ham nomutanosib e'tiborni jalb qiladi. Garchi OS va tizim kodi tahlil qilingan umumiy sonning 23 foizini tashkil etsa-da, ular foydalanilgan zaifliklarning 41 foizini tashkil etadi.
Zaifliklar ta'sirlangan platformalar bo'yicha tasniflangan, jumladan Windows, Linux/Unix, mobil, tarmoq qurilmalari, IoT/OT, virtualizatsiya xostlari va ishlab chiquvchi paketlari.
2026-yil sentyabr holatiga ko'ra e'lon qilingan CVE larning to'liq populyatsiyasi (Manba: Microsoft).
Ilova kodi e'lon qilingan zaifliklarning qolgan 77 foizini tashkil etadi. Microsoft tasniflashning o'zi yetarli emasligini ogohlantiradi: ko'rinishidan kod bajarish zaifligi amaliy foydalanish sharoitida faqat tizimning ishdan chiqishiga olib kelishi mumkin.
Microsoft Security Exposure Management telemetriyasi operatsion nomutanosiblikni ko'rsatadi.
O'rtacha tuzatish Windows ish stansiyalarida taxminan ikki hafta, Windows Serverlarda bir oydan ortiq va Linux serverlari hamda macOS ilovalarida o'n haftadan ortiq vaqt oladi.
Tarmoq qurilmalari eng uzoq kechikishni ko'rsatadi — bir yildan ortiq, bu esa muhim infratuzilmani odatiy favqulodda javob sikllaridan ancha uzoqroq ochiq qoldiradi.
1 239 ta foydalanilgan CVE bo'yicha tahlil qilingan uchta masofaviy egallab olish sinfi, har biri ta'sirlangan platforma bo'yicha chuqurlashtirilgan (Manba: Microsoft).
Mustaqil tadqiqot shoshilinchlikni tasdiqlaydi. VulnCheck'ning 2026-yilgi foydalanish holati bo'yicha hisobotida 2025-yil davomida birinchi marta foydalanish dalillari aniqlangan 884 ta zaiflik qayd etilgan.
Ularning 28,96 foizi CVE e'lon qilingan sanada yoki undan oldin foydalanilgan, bu esa e'lon himoyachilarga oldindan ogohlantirish emas, balki hujumlar allaqachon boshlanganidan keyin kelishi mumkinligini ko'rsatadi.
Microsoft shuningdek, sun'iy intellekt yordamida zaifliklarni aniqlash va ekspluatatsiya ishlab chiqish javob oynalarini yanada qisqartirishi mumkinligi haqida ogohlantiradi.
Biroq himoyachilar foydalanish sanalarini katalogga kiritish sanalaridan farqlashi kerak: e'lon qilishdan ro'yxatga kiritishgacha bo'lgan oraliq hisobot berish va kuratsiya jarayonlarini o'lchaydi, hujumchilar zaiflikni birinchi marta qurollantirgan sanani emas.
Microsoft tuzatish qarorlarini ta'sir bilan birga ta'sirchanlikni ham birlashtirish kerakligini ta'kidlaydi. Buzilgan server uning xizmat hisoblari, bulut identifikatorlari, ruxsatlari yoki ishonchli ulanishlari qo'shimcha tizimlarga kirish imkonini berganda ancha xavfliroq bo'ladi.
Shuning uchun bir xil zaiflik ta'sirlangan aktivning pozitsiyasiga qarab turli biznes xavflarini yaratishi mumkin.
Microsoft Defender External Attack Surface Management bu yondashuvni qo'llab-quvvatlaydi, internetga ochiq infratuzilmani, jumladan ilgari noma'lum aktivlar va uchinchi tomon bog'liqliklarini aniqlaydi.
Uning inventarizatsiyasi himoyachilarga ochiq tizimlarning tashqi ko'rinishini beradi. Microsoft tahlili zaifliklarni ustuvorlashtirish va hujum yo'llarini baholashni ta'kidlaydi, bu esa ochiq ish yuklaridan muhim resurslargacha bo'lgan yo'llarni aniqlashga yordam beradi.
Tuzatish kechiktirilgan hollarda, keraksiz ta'sirchanlikni bartaraf etish va ortiqcha imtiyozlarni cheklash keyingi buzilishlarni cheklashga yordam berishi mumkin.
Mavjudlik jihatidan muhim xizmatlar va ochiq hisob ma'lumotlari, ularning biznes konteksti oqibatlarni jiddiy qilganda, shoshilinch e'tiborni talab qiladi.
Microsoft’s analysis of approximately 383,000 disclosed vulnerabilities shows that attackers overwhelmingly favor weaknesses enabling system takeover rather than exploiting vulnerabilities indiscriminately.
The research identifies 2,056 CVEs linked to real-world exploitation, roughly 0.5% of the population, highlighting why vulnerability management must prioritize demonstrated attacker utility over disclosure volume or severity scores alone.
Covering vulnerabilities published from 1999 through September 2026, Microsoft’s catalog-based assessment classifies vulnerabilities by their most consequential direct impact and affected platforms.
Its central finding is that takeover vulnerabilities, including remote code execution, authentication bypass, and local privilege escalation, account for 78% of exploited vulnerabilities.
These weaknesses can compromise network-exposed services without user interaction, making them valuable entry points.
Local privilege escalation increases from 11% of disclosures to 18% of exploited vulnerabilities, helping attackers convert limited footholds into privileged access.
Client-side remote code execution shows an even sharper proportional increase, rising from 4% of disclosed CVEs to 13% of exploited vulnerabilities.
Unlike server-side exploitation, these attacks require victims to open or execute malicious content. Conversely, cross-site scripting declines from 15% to 4%, while denial-of-service vulnerabilities fall from 16% to 7%.
Microsoft Researchers said that, Server-side remote code execution represents 20% of published vulnerabilities but 37% of exploited CVEs.
383,000 Vulnerabilities Analyzed
Operating-system vulnerabilities also attract disproportionate attention. Although OS and system code account for 23% of the analyzed population, they represent 41% of exploited vulnerabilities.
Classified vulnerabilities by the platforms they affect, including Windows, Linux/Unix, mobile, network appliances, IoT/OT, virtualization hosts, and developer packages.
The full published-CVE population as of September 2026 (Source : Microsoft).
Application code constitutes the remaining 77% of disclosures. Microsoft cautions that classifications alone are insufficient: an apparent code-execution vulnerability may produce only crashes under practical exploitation conditions.
Microsoft Security Exposure Management telemetry illustrates the operational imbalance.
Median remediation takes approximately two weeks on Windows workstations, more than a month on Windows Servers, and over ten weeks on Linux servers access and macOS applications.
Network appliances show the longest delay, exceeding one year, leaving critical infrastructure exposed well beyond typical emergency-response cycles.
The three remote-takeover classes analyzed across 1,239 exploited CVEs), each drilled down by affected platform (Source : Microsoft).
Independent research reinforces the urgency. VulnCheck’s State of Exploitation 2026 identified 884 vulnerabilities with first-time exploitation evidence during 2025.
Of these, 28.96% were exploited on or before their CVE publication date, demonstrating that disclosure may arrive after attacks have already begun rather than providing defenders an advance warning.
Microsoft also warns that AI-assisted vulnerabilitydiscovery and exploit development could further compress response windows.
However, defenders must distinguish exploitation dates from catalog inclusion dates: publication-to-listing intervals measure reporting and curation processes, not necessarily when attackers first weaponized a weakness.
Microsoft argues that remediation decisions should combine impact with exposure. A compromised server becomes substantially more dangerous when its service accounts, cloud identities, permissions, or trusted connections provide access to additional systems.
Consequently, the same vulnerability can create different business risks depending on the affected asset’s position.
Microsoft Defender External Attack Surface Management supports this approach by discovering internet-facing infrastructure, including previously unknown assets and third-party dependencies.
Its inventory gives defenders an external view of reachable systems. Microsoft’s analysis further emphasizes vulnerability prioritization and attack-path assessment to identify routes from exposed workloads to critical resources.
Where patching is delayed, removing unnecessary exposure and restricting excessive privileges can help limit subsequent compromise.
Availability-critical services and exposed credentials still warrant urgent attention when their business context makes consequences severe.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.