Microsoft has put numbers on something most security teams already suspected. The devices most likely to be exploited first are the ones patched last. In its 2026 data, the median time to patch a Windows workstation is about two weeks. For network appliances it is more than a year.
What the data says
On 2 November, Microsoft Threat Intelligence published an analysis of every vulnerability in its catalogue from 1999 to September 2026. Of roughly 383,000 published CVEs, 2,056 have been linked to real-world exploitation, about 0.5%. The exploited ones are not a random sample:
- Server-side remote code execution is 20% of published CVEs but 37% of exploited ones.
- Remote code execution, authentication bypass and privilege escalation together make up 78% of exploited vulnerabilities.
- Median time to patch, from Microsoft Security Exposure Management data for 2026: about two weeks for Windows workstations, more than a month for Windows servers, ten weeks or more for Linux servers, and more than a year for network appliances.
- The time from publication to a CVE appearing in CISA's Known Exploited Vulnerabilities catalogue has collapsed. The mean was 89 days in 2024 and 57 in 2025. For 2026 so far, the mean is 20 days and the median is three.
Put the last two points together. On a typical appliance, an exploited flaw is in attackers' hands for months before it is fixed.
This week's example
The Ivanti Connect Secure chain shows how this plays out. Exploitation started on 3 October. Ivanti shipped a fix on 13 October, then two more on 29 October for flaws that were part of the same chain. A team that patched promptly in mid-October still had to patch again two weeks later. The attacker left no implant, and the vendor's integrity checker reported the appliance clean. The damage was done in Active Directory, using the appliance's own service account. We cover the hunt in our threat research post.
That is the best case: a well-run team with a vendor that ships fixes quickly. The median appliance, by Microsoft's numbers, does far worse.
Why appliances fall behind
The reasons are rarely negligence. They are structural:
- Nobody owns them. The firewall belongs to networks, the VPN to infrastructure, the storage to a supplier. Patch reports are built around Windows, so appliances don't appear on them.
- Patching means downtime. Rebooting the VPN disconnects everyone working remotely. Changes wait for a window, and windows get missed.
- Fixes come in waves. As in the Ivanti case, the first fix is often incomplete. Each round needs another change.
- Endpoint tools can't see inside. You can't install an EDR agent on most appliances, so an attacker on the box is invisible to the tools the SOC relies on.
We argued in 1,413 CVEs In One Month that exploitability should rank your patch list. Microsoft's data adds a second point: where a fix lands matters as much as how severe it is. An exploited flaw on an appliance is not a patching task to schedule. It is an incident to manage.
What to do while the patch gap exists
You will not get appliance patching down to two weeks this year. You can shrink what an attacker gets in the time it takes.
- Keep an edge register with named owners. List every internet-facing appliance with its version, who patches it and who approves the downtime. If it isn't on the list, nobody will patch it in a hurry.
- Agree an emergency route now. When an edge device appears in the KEV catalogue, the change should already be pre-approved. A three-day median doesn't fit a monthly change board.
- Treat every emergency patch as a possible compromise. If the flaw was exploited before you patched, assume the device was touched. Check it, and rotate the credentials it holds: service accounts, certificates, admin passwords.
- Watch the appliance from the outside. Send its logs to your SIEM, and watch what its accounts do in Active Directory and Entra ID. When a VPN's service account starts reading LAPS passwords, the evidence is on your domain controllers, not on the box.
- Cut the exposure. Take management interfaces off the internet, limit who can reach the portal where you can, and give each appliance's directory account the least access it needs. We cover that in The Appliance Account That Could Read Every LAPS Password.
Where a SOC fits
Patching is the fix, and there is no replacement for it. The months before the fix lands are a detection problem. A SOC that knows which accounts belong to your edge devices, and what they normally do, can see an appliance misbehaving even when the appliance itself reports nothing. Our SOCs are staffed 24/7, and our vulnerability and patch management service can help you build the edge register and the emergency route, so the kit that doesn't appear in a Windows patch report gets the same attention.
If your appliances are among Microsoft's median, talk to our team about closing the gap.