Network Appliance Vulnerabilities Stay Unpatched for Over a Year as Exploits Accelerate

Attackers can move from vulnerability disclosure to exploitation in days, while enterprises take more than a year to patch flaws on network appliances. That timing gap is the central finding in Microsoft Security Research’s analysis of roughly 383,000 CVEs disclosed between 1999 and September 2026.

Microsoft’s 2026 telemetry puts median patch time at about two weeks for Windows workstations and more than a month for Windows servers. Linux servers and applications running on macOS take over 10 weeks; network appliances exceed a year. “That gap is the threat actor’s window, widest on the critical systems that stay exposed the longest,” researchers Yair Tsarfaty and Or Begam wrote in a blog post.

Operational constraints leave appliances exposed

The patching figures come from Microsoft Security Exposure Management data. Vibhum Dubey, a cybersecurity researcher and red teamer, said the timelines match what he sees in enterprise environments, where approvals, application dependencies, maintenance windows, and older infrastructure slow remediation.

Network appliances can be especially hard to update because firmware changes may disrupt business operations. “In many cases, the challenge is not identifying vulnerabilities, but getting the right teams to remediate them without disrupting business services,” Dubey said. The bottleneck, in other words, often sits between discovering a flaw and coordinating a safe fix.

Attack timelines have compressed

Microsoft cited CISA data showing that the mean time between CVE publication and inclusion in the Known Exploited Vulnerabilities catalog fell from 89 days in 2024 to 57 days in 2025. Through September 2026, the mean was 20 days and the median just three. The researchers said the most consequential flaws are increasingly exploited within days, sometimes on or before disclosure.

VulnCheck’s State of Exploitation 2026 report found that 29% of exploits in 2025 launched within one day of CVE publication. Microsoft also pointed to industry research linking advances in AI with faster exploit development.

Dubey said organizations may have only hours to respond when exploitation begins before public disclosure or before security teams finish their first assessment. Monthly scans and routine patch cycles can’t keep pace on their own. He recommends continuous monitoring, emergency patch procedures, virtual patching through WAF and IPS controls, and clear ownership for remediation.

“The priority should be to reduce the window of exposure, because by the time a vulnerability reaches the regular patching queue, attackers may already be exploiting it,” he said.

Exploit data points to access and control

The flaws attackers use differ sharply from the broader CVE pool. Server-side remote code execution (RCE) makes up 20% of published CVEs but 37% of those exploited in the wild. Local privilege escalation rises from 11% to 18%, while client-side RCE grows from 4% to 13%.

Other categories appear less often in real-world exploitation: cross-site scripting falls from 15% of published CVEs to 4% of exploited ones, and denial-of-service flaws drop from 16% to 7%. Operating system vulnerabilities account for 23% of all CVEs in the analysis but 41% of exploited cases. RCE, authentication bypass, and local privilege escalation together make up 78% of exploited vulnerabilities. Windows is the most affected platform in Microsoft’s data.

“These patterns are consistent with threat actors favoring vulnerabilities that can provide meaningful access and control,” the researchers wrote. The distribution suggests that prioritization needs to account for what a flaw lets an attacker do, as well as its severity rating.

Exposure changes the priority

Microsoft frames attacker value around two factors: impact, or what exploitation enables, and exposure, meaning the identities, privileges, and network connections reachable from the compromised asset. Servers may carry service accounts, application identities, or cloud-managed identities with broader permissions than necessary. A compromised server can therefore provide a route to sensitive data, administrative access, or trusted networks.

Dubey said CVSS scores alone don’t capture that context. Teams should weigh active exploitation, internet exposure, asset criticality, and reachable attack paths. A known exploit on an internet-facing system can demand attention before a higher-scoring flaw on an isolated asset. With appliance patching measured in years and exploitation measured in days, organizations need to connect vulnerability response to the systems and access attackers can actually reach.