Network appliances go more than a year without patches as exploits speed up

Publisher excerpt From CSO Online

The median vulnerability on enterprise network appliances stays unpatched for more than a year, Microsoft’s own telemetry shows, even as the most damaging software flaws are being weaponized within days of disclosure. Microsoft Security Research reported the findings Monday in an analysis of roughly 383,000 CVEs disclosed from 1999 through September 2026. It shows that the median time to patch a vulnerability exceeds a year for network appliances. The period is more than a month for Windows servers, over 10 weeks for Linux servers and applications running on macOS, and about two weeks for Windows workstations. “That gap is the threat actor’s window, widest on the critical systems that stay exposed the longest,” Microsoft Security researchers Yair Tsarfaty and Or Begam wrote in a blog post detailing the findings. They were referring to the distance between how fast flaws are exploited and how slowly critical systems are patched. Patching measured in weeks and months Microsoft drew its patching figures from 2026 data in its Security Exposure Management product. The median vulnerability is fixed in about two weeks on Windows workstations but takes more than a month on Windows Server, according to the post. The delay stretches beyond 10 weeks on Linux servers and for applications running on macOS, and past a year on network appliances. Vibhum Dubey, a cybersecurity researcher and red teamer, said the findings reflect what he sees across enterprise environments. In those environments, change approvals, application dependencies, maintenance windows, and legacy infrastructure routinely hold up fixes. “Network appliances are particularly difficult because firmware upgrades can affect critical business operations,” Dubey said. “In many cases, the challenge is not identifying vulnerabilities, but getting the right teams to remediate them without disrupting business services.” Exploitation measured in days Exploitation runs on a far shorter clock, Microsoft wrote in the post. Citing CISA figures, the researchers said the mean time from CVE publication to listing in CISA’s Known Exploited Vulnerabilities catalog fell from 89 days in 2024 to 57 days in 2025. For 2026 through September, the mean has dropped to 20 days and the median to three. “Exploitation runs on the opposite clock: the most impactful vulnerabilities are weaponized in days, increasingly on or before disclosure,” the post said. The researchers also cited VulnCheck’s State of Exploitation 2026 report, which found that 29% of exploits in 2025 were launched within a day of CVE publication. Industry research points to advances in AI as a significant factor in cutting the time needed to develop exploits, Microsoft wrote in the blog post. In some cases, defenders have hours rather than weeks, Dubey said. Vulnerabilities can be exploited before public disclosure or before organizations have completed their initial assessment. He said enterprises need to move away from relying entirely on…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.