97% of critical vulnerabilities are never exploited by anyone

31 July 2026 · Carl Heaton · Security Deep dive

A vulnerability scored 9.8 out of 10 sounds like something happening to you. Mostly it is not. Of the 20,491 vulnerabilities in our analysis carrying a severity score of 9.0 or higher, 570 show any evidence of ever being exploited in a real attack. That is 2.8%. The other 97.2% have sat there, scored critical, and been used against nobody.

This is not an argument for ignoring severity scores. It is an argument for understanding what they measure, because the mismatch runs in both directions and the second direction is the dangerous one.

The scores that were too low

We looked at the 1,758 vulnerabilities confirmed as exploited in the wild and asked what they had been scored.

Severity band	Confirmed-exploited flaws	Share
Critical, 9.0 to 10.0	570	35.3%
High, 7.0 to 8.9	858	53.1%
Medium, 4.0 to 6.9	185	11.4%
Low, below 4.0	4	0.2%

189 of the 1,617 scored entries, close to one in eight, sat below 7.0. A business patching strictly by the common "7 or above" rule would have skipped every one of them, and they were being used in real attacks.

Worse: a further 141 confirmed-exploited vulnerabilities carried no severity score at all. Not a low score. No score. A threshold filter does not skip these loudly, it drops them silently, because there is no number to compare against the threshold. That is arguably a worse failure than a wrong score, and it is invisible unless you go looking.

One honest note that cuts against our own figure. The scores we analysed are current ones, not the score each flaw carried on the day it was published, and severity ratings tend to get revised upwards once exploitation becomes known. So the real proportion scored below 7 at the moment a defender first had to decide is higher than one in eight. We cannot say how much higher, because that history is not recorded anywhere we could read it.

What actually predicts exploitation

The severity score is built from a vector of components: how the flaw is reached, how hard it is to pull off, what privileges you need first, whether a user has to click something. The headline number blends them all.

Taken separately, some of those components discriminate and one does not.

Vulnerabilities requiring no privileges at all were roughly three times more likely to end up exploited than those needing even low privileges. Vulnerabilities requiring no user interaction were around three times more likely than those needing someone to click. Both make intuitive sense: attacks that run without help scale, and attacks that need help do not.

Attack complexity, the component that asks how difficult the exploit is to execute, did not discriminate at all. Low-complexity and high-complexity flaws were exploited at almost identical rates. That is a genuinely useful negative result, because complexity carries real weight in the severity formula. It is telling you something the evidence does not support.

We are giving these as directions, not multipliers. Only 69 of the confirmed-exploited flaws in our data carry a full scoring vector, so the counts behind those ratios are small. The ordering is stable. The exact numbers are not, and we would not want you quoting them.

A third of the record has no score at all

Of the 248,176 vulnerability records we analysed, 77,303 carry no severity score of any kind. That is 31%.

Some of that is expected. About 17,600 are rejected entries, withdrawn after being issued, which correctly have no score. Strip those out and roughly 24% of the genuine record is unscored.

Some of it is ordinary backlog. Scoring lags publication, so recent years always look worse: 42% of 2026 records were unscored when we looked, which will improve.

But 36.8% of 2023 records are still unscored, three years on. Those are not waiting for anyone. Compare that to 2024, at 8.9%, and the pattern is not a smooth decay from a scoring queue. It looks like a specific period where the scoring effort upstream fell behind and never caught up.

The practical consequence is the same either way. Any tool, policy, or standard that filters by severity is silently ignoring a quarter of the record.

What to do with this

Treat a critical score as "look at this", not "this is happening". Check whether anything suggests real-world exploitation before you declare an emergency out of hours.
Do not let a threshold be your only filter. Anything scored below your cutoff, or carrying no score, never reaches you at all. That is where one in eight of the real attacks were hiding.
Look at the vector, not just the number. No privileges required and no user interaction needed are the two components worth reading. Attack complexity, on this evidence, is not.
Ask what happens to unscored vulnerabilities in whatever tool or service you use. "It has no CVSS so it did not appear" is a real failure mode.

How Steelwise can help

If you want a straight answer about whether your current patching approach is missing the things that matter, that is exactly the kind of question a security review answers. Get in touch.

About the data. Figures come from our analysis of 248,176 public vulnerability records sourced via StackFlag, which is a Steelwise product. The underlying data is public: the National Vulnerability Database, CISA's Known Exploited Vulnerabilities catalogue, and GitHub Security Advisories. Exploitation is measured against CISA's catalogue, which records confirmed exploitation rather than all of it, so every figure here is a floor.

If you spot an error in this filing, tell us and we will correct it and note the change.