Researchers find that only 4,183 security flaws from a total of 76K vulnerabilities discovered between 2009 and 2018 had been exploited in the wild
Most vulnerabilities that are exploited in the wild have a CVSS severity score of 9 or 10. — New research published this week has shed …
Context & Ripple Effects
This study lands at the start of a decade-long argument about what all those CVE numbers actually mean for defenders. It found that of 76,000 vulnerabilities disclosed between 2009 and 2018, only 4,183 were ever exploited in the wild — and the ones attackers chose were overwhelmingly the CVSS 9–10 flaws.
The finding has aged into a counterweight to raw disclosure-volume panic: the CVE program's tally has since pushed past 270K IDs, and the NVD is now on pace to roughly double its annual flaw count, while Google researchers counted 97 zero-days exploited in 2023, up 50% year over year. Exploitation is growing, but far slower than the catalog itself.
First-order effects
- Security teams running CVSS-driven patch triage get empirical backing: prioritizing severity-9 and 10 fixes aligns with how attackers actually behaved across the decade studied, letting them deprioritize the long tail of low-severity advisories.
Second-order effects
- Vendors and open source projects face asymmetric scrutiny — RiskSense's finding that vulnerabilities in top open source projects doubled from 2018 to 2019 matters less if most of those bugs are never weaponized, shifting pressure toward proof-of-exploit data over raw bug counts.
Third-order effects
- If disclosure volume keeps compounding while exploitation stays concentrated, the industry's center of gravity moves from counting CVEs to tracking exploited ones — the zero-day tallies from Mandiant and Google become the headline metric, and CISA-style known-exploited catalogs become the de facto triage layer.
The trend: Vulnerability disclosure keeps scaling faster than exploitation ever will, pushing defenders from volume-based patching toward exploit-evidence-based prioritization.