Today, ESET published Windows Exploitation in 2016, an annual report that summarizes the highs and lows of the most widely used operating system, Microsoft Windows®. Across the report’s 25 pages, ESET gives an overview of the vulnerabilities that have occurred over the past 12 months, providing details on infamously vulnerable components such as Internet Explorer and Windows User-Mode Components.

Compared to last year’s report, Windows Exploitation in 2016 discloses that the number of fixed vulnerabilities in Windows increased in all segments except one, Internet Explorer (IE). It saw a steep drop in the number of vulnerabilites falling from 242 to 109 over the past twelve months.

On the other hand, Windows User-Mode Components, a processor mode where a majority of applications and some drivers for Windows OS run, lost nothing to its popularity among cybercriminals. In the report, ESET identifies Windows User-Mode Components with 116 fixed vulnerabilities as the leader in 2016’s chart. Among the most prevalent ways cybercriminals misuse 0-days in User-mode is remote code execution and elevation of the privileges of malicious components.

Despite being the newcomer in the report, Microsoft Edge, has been resistant to exploitation, and as a close second it has been attributed with its first 111 vulnerabilities patched. Unlike IE, Edge keeps modern security features such as AppContainer or 64-bit processes for tabs turned on by default, which makes it less vulnerable.

The Windows Exploitation Report 2016 contains detailed statistics about vulnerabilities fixed in Microsoft-supported versions of Windows, its components, web browsers, as well as the Office suite, and also provides information about issued updates. The report’s author also took a detailed look at exploit mitigations in recent Windows versions and the security effectiveness of major web browsers, as they represent very attractive targets for attackers.

To download the complete Windows Exploitation in 2016 report, click here. To read more about information security on ESET’s official blog, WeLiveSecurity.com, or learn about ESET’s advanced security technologies.