The year-long patch gap on network appliances

A vulnerability in an enterprise network appliance sits unfixed for more than a year, on median, according to telemetry Microsoft Security Research published Monday. The same vulnerabilities that cause the most damage are being exploited within days. That mismatch — slow patching on the systems attackers most want to reach — is the central finding of an analysis covering roughly 383,000 CVEs disclosed from 1999 through September 2026.

The research, detailed in a blog post, compares how long defenders take to fix flaws against how quickly attackers weaponize them. The researchers describe the gap between those two clocks as the window threat actors operate in, and note it is widest on the critical systems that stay exposed the longest.

The patching figures come from 2026 data in Microsoft's Security Exposure Management product. They place the median time to fix a vulnerability at about two weeks on Windows workstations. From there, the numbers climb sharply depending on the asset.

Weeks on servers, a year on appliances

Windows workstations are patched in roughly two weeks, the fastest category in Microsoft's data. Windows Server takes more than a month. Linux servers and applications running on macOS stretch beyond 10 weeks. Network appliances exceed a year.

The appliance figure is the outlier in the data, and it corresponds to the class of device that sits closest to the perimeter in many enterprise networks — the equipment that terminates connections, routes traffic, and enforces access before traffic ever reaches a server.

Vibhum Dubey, a cybersecurity researcher and red teamer, said the pattern matches what he encounters in enterprise environments, where change approvals, application dependencies, maintenance windows, and legacy infrastructure routinely hold up fixes. Appliances add a further constraint because of how they are maintained.

“Network appliances are particularly difficult because firmware upgrades can affect critical business operations,” Dubey said. “In many cases, the challenge is not identifying vulnerabilities, but getting the right teams to remediate them without disrupting business services.”

— Vibhum Dubey, cybersecurity researcher and red teamer

That framing places the delay less in detection than in process. The vulnerabilities are known; the difficulty lies in scheduling a change to a device whose failure would interrupt business operations.

Exploitation runs on a shorter clock

The exploitation timeline moves in the opposite direction. Citing CISA figures, Microsoft researchers Yair Tsarfaty and Or Begam reported that the mean time from CVE publication to listing in CISA's Known Exploited Vulnerabilities catalog fell from 89 days in 2024 to 57 days in 2025. For 2026 through September, the mean dropped to 20 days and the median to three.

The researchers also cited VulnCheck's State of Exploitation 2026 report, which found that 29% of exploits in 2025 were launched within a day of CVE publication. Microsoft's post points to advances in AI as a significant factor in cutting the time needed to develop exploits.

“Exploitation runs on the opposite clock: the most impactful vulnerabilities are weaponized in days, increasingly on or before disclosure,” the post said.

— Microsoft Security researchers Yair Tsarfaty and Or Begam, in the blog post

Dubey said defenders sometimes have hours rather than weeks. Vulnerabilities can be exploited before public disclosure or before an organization has finished its initial assessment of a new CVE.

He argued that enterprises need to move away from relying entirely on monthly scans and scheduled patch cycles, and toward continuous monitoring, emergency patching procedures, virtual patching through WAF and IPS controls, and clear remediation ownership.

“The priority should be to reduce the window of exposure, because by the time a vulnerability reaches the regular patching queue, attackers may already be exploiting it,” Dubey said.

— Vibhum Dubey, cybersecurity researcher and red teamer

The flaws attackers actually reach for

The population of vulnerabilities attackers exploit does not resemble the CVE catalog as a whole. Microsoft's analysis found that server-side remote code execution flaws make up 20% of all published CVEs but 37% of those exploited in the wild. Local privilege escalation climbs from 11% to 18%. Client-side RCE rises from 4% to 13%.

Other categories fall in the other direction. Cross-site scripting drops from 15% of published CVEs to 4% of exploited ones. Denial-of-service flaws drop from 16% to 7%. Operating system vulnerabilities make up 23% of the overall population but account for 41% of exploited CVEs.

Windows ranks as the most affected platform among exploited CVEs in Microsoft's data. Taken together, RCE, authentication bypass, and local privilege escalation account for 78% of real-world exploited vulnerabilities.

“These patterns are consistent with threat actors favoring vulnerabilities that can provide meaningful access and control,” the researchers wrote.

— Microsoft Security researchers Yair Tsarfaty and Or Begam, in the blog post

The concentration matters for prioritization. A flaw that grants an attacker a foothold with meaningful privileges is worth more to them than a flaw that degrades a service or runs code in a victim's browser, and the exploitation data reflects that preference.

Impact plus exposure, not score alone

Microsoft's post argues that a vulnerability's value to an attacker depends on two things: impact and exposure. Impact is what successful exploitation delivers. Exposure is the set of identities, privileges, and network connections reachable from the compromised asset.

Servers frequently run service accounts, application identities, or cloud-managed identities with more permissions than they need, according to the post. Taking over one of those accounts can open paths to sensitive data, administrative rights, and trusted networks — which means the consequence of a single compromised host depends heavily on what that host can reach.

That is where the appliance problem compounds. A device that is slow to patch and rich in reachable privileges combines both halves of the risk equation.

Dubey on why CVSS falls short

Dubey said severity scoring by itself no longer captures what defenders need to act on. Organizations should rank vulnerabilities by active exploitation, internet exposure, asset criticality, and potential attack paths, he said.

“CVSS scores alone are no longer sufficient,” Dubey said. “A medium-severity vulnerability on an internet-facing system with a known exploit can present a greater risk than a critical vulnerability on an isolated asset.”

— Vibhum Dubey, cybersecurity researcher and red teamer

The point aligns with the exploitation data. A flaw that is already being used, on a system that is reachable, carries a different kind of urgency than a higher-scored flaw on a machine nobody can touch.

The numbers that frame the gap

Microsoft's post is built on a set of measurements that, taken together, describe the distance between defensive and offensive timelines.

• 383,000 — approximate number of CVEs analyzed, disclosed from 1999 through September 2026
• More than a year — median time to patch a vulnerability on network appliances
• More than a month — median time to patch on Windows Server
• More than 10 weeks — median time to patch on Linux servers and applications running on macOS
• About two weeks — median time to patch on Windows workstations
• 89 days — mean time from CVE publication to CISA KEV listing in 2024
• 57 days — same measure in 2025
• 20 days — mean in 2026 through September
• Three — median in 2026 through September
• 29% — share of 2025 exploits launched within a day of CVE publication, per VulnCheck
• 78% — share of real-world exploited vulnerabilities accounted for by RCE, authentication bypass, and local privilege escalation combined

Where the delay actually lives

The patching numbers are medians, which means half of the vulnerabilities in each category take longer than the stated period to fix. For network appliances, that puts a substantial portion of flaws well beyond a year.

Dubey's account of enterprise practice suggests the delay is structural rather than a matter of neglect. Change approvals, application dependencies, maintenance windows, and legacy infrastructure all appear on his list of routine obstacles. Each one represents a step that has to be cleared before a fix reaches production.

For appliances, firmware upgrades add the risk that the fix itself disrupts operations. That risk has to be weighed against the risk of leaving the flaw in place, and the Microsoft data suggests the weighing often resolves toward delay.

The exploitation figures show what that delay costs. When the median time to exploitation drops to three days, a remediation cycle measured in months leaves an opening that stretches far beyond the period between disclosure and attack.

What the gap means for defenders

The practical consequence for organizations is that patching speed alone cannot close the distance Microsoft measured. If the median appliance flaw takes more than a year to fix and the median exploited flaw is weaponized in three days, then a schedule built around routine patch cycles will consistently arrive after attackers have already moved.

Dubey's suggested controls — continuous monitoring, emergency patching procedures, virtual patching through WAF and IPS controls, and clear remediation ownership — are aimed at shrinking the exposure window rather than eliminating the underlying delay. Virtual patching in particular can buy time on devices where a firmware upgrade is disruptive, though it depends on the protective control actually covering the flaw in question.

The prioritization argument carries a similar implication. If RCE, authentication bypass, and local privilege escalation account for 78% of exploited vulnerabilities, and if operating system flaws account for 41% of exploited CVEs despite being 23% of the population, then triage based on volume or raw severity will direct attention away from the flaws most likely to be used. Ranking by active exploitation, internet exposure, and what a compromised asset can reach points attention toward the systems where the window is both widest and most valuable to an attacker.

For appliance owners specifically, the data suggests the devices deserving the most urgent attention are the ones that are reachable, slow to update, and hold identities or network paths beyond what they strictly need. Microsoft's finding is that exposure and impact together determine an attacker's return — and its patching telemetry shows where that combination tends to persist longest.