The U.K. National Cyber Security Center (NCSC) warned that the widespread availability of AI-powered cyber tools has "almost certainly" spurred a surge in zero-day discovery, while an analysis of roughly 383,000 CVEs disclosed from 1999 through September 2026 found the median time to patch a vulnerability exceeds a year for network appliances. Microsoft said the median vulnerability is patched in about two weeks on Windows workstations, more than a month on Windows Servers, 10+ weeks on Linux servers and macOS applications, and beyond a year on network appliances. The report noted that only about 0.5% of the 2,000 CVEs linked to real-world exploitation, but attackers focus on flaws that enable remote code execution, privilege escalation and authentication bypass, exploiting the long exposure window of critical systems. 1