Stop every
unwanted change.
Book a Demo
Company
CareersThanks, we'll be in touch
Oops! Something went wrong while submitting the form.
Copyright Mimic 2026
Missing Patches is a continuous assessment of vulnerability exposure across the production server estates Mimic monitors. The live view on this page is the working surface, and it requires sign-in; this page describes what the dataset measures, where its records come from, and what it deliberately does not claim.
For each server, the software observed on disk is matched to its entry in the CPE (Common Platform Enumeration) dictionary and compared against the public vulnerability record: CVE identifiers and their affected-version ranges from NVD, and known-exploited status from CISA's Known Exploited Vulnerabilities catalog. The result is a per-server exposure finding — which installed software is running at a version reported as affected, and which of those vulnerabilities attackers are already known to be using.
Two things separate it from the vulnerability statistics usually published. The first is that it is observed rather than reported: the assessment reads the binaries on the disk, not an inventory system's record of what should be there. The second is the population. Figures cover production customer environments only — development, proof-of-concept and internal environments are excluded — so the numbers describe estates running real workloads rather than a blend diluted by machines nobody depends on and nobody patches.
The share of monitored servers that could be assessed at all, and of those, the share running at least one product at a version the public record reports as affected. This is the broad, low-grade layer, and it is consistently large — the ordinary condition of a server estate rather than an emergency.
The subset that matters most operationally: software carrying vulnerabilities CISA has confirmed exploited in the wild, and within that, the ones CISA records as used in ransomware campaigns. Known-exploited status makes a far better remediation queue than CVE volume or peak severity score, because it separates vulnerabilities someone already has working code for from vulnerabilities that merely exist. The dataset ranks both the products and the individual CVEs by how widespread they are across servers, and records the month each entered CISA's catalog. Flags are matched on the CVE identifier rather than the product name, so known-exploited means this vulnerability is on CISA's list, not that something else in the same product family once was.
Windows is not patched component by component; it is patched by cumulative update, so a server's patch level is a single revision number and a host at that revision has every fix shipped at or below it. That makes the gap calculable in a way a version-by-version comparison cannot manage, and it is calculated separately: the server's build and revision — reported by the host where available, otherwise estimated from the versions of its own OS binaries — is compared against Microsoft's published update ledger to give the fixes shipped since. The dataset carries the share of Windows servers estimated to be more than one servicing month behind, and folds those missed fixes into the same ranking as the version-level findings. Both halves are counted: software observed at an affected version, and Microsoft fixes a server's patch level has not reached.
The same assessment cut by customer environment instead of blended across everything monitored, so the shape of the distribution is visible rather than just its average. The recurring pattern is that broad exposure is near-universal while the urgent portion is tightly concentrated — a small number of environments, and within them a small number of products, account for most of the known-exploited findings. That is a more encouraging finding than the headline suggests: the genuinely actionable backlog is smaller and far more specific than a raw CVE count implies. The cohort publishes nothing unless it clears a minimum number of production environments, and an environment with too few observed servers is left out rather than shown.
An unpatched server is only a problem if the gap between disclosure and exploitation is short enough for someone to use it. For most of the last two decades it was not, and enterprise patch cycles were designed around that assumption. That assumption no longer holds, and The Patch Window tracks the disclosure-to-exploitation interval as it stands today.
Set that against a patch cycle. Thirty to forty-five days is a normal, competent interval for a production estate — testing, change approval and staged rollout exist for good reasons, and skipping them causes outages. The problem is arithmetic rather than diligence. When the interval to a working exploit is shorter than the interval to a deployed patch, the exposure is structural, and patching faster does not close it. Missing Patches is the measurement of what that arithmetic leaves behind on real servers.
It also explains why the dataset's most useful column is not the largest one. The highest CVSS scores in any estate tend to sit on browsers and utility software that publish hundreds of CVEs against even a current build. The riskiest software on a server is rarely the software anyone thinks about — a virtualisation guest agent or a legacy runtime installed everywhere and owned by no one is where known-exploited versions survive, precisely because nobody has been asked to look after them.
Being explicit about the limits is part of publishing the numbers at all. An exposure finding is not an exploitability verdict: the percentages count servers running product versions the public record reports as affected, and a backported vendor patch, a compensating control, or configuration can make an affected version safe, none of which are visible to this assessment.
Absence from the assessment is not evidence of safety. Only products mapped in our CPE dictionary are assessed; unassessed software is absent from the figures rather than counted as clean. An environment whose software has not been assessed is left out of the cohort rather than shown at zero, and the cohort withholds itself entirely below its own minimum size.
The Windows figure is an estimate. Where a host does not report its own patch level it is derived from the versions of its OS binaries, and gaps of one servicing month or less are suppressed. It describes fixes shipped since a server's patch level, not a judgment that the server is exploitable.
Percentages only. The dataset publishes shares, never fleet size, server counts, or anything from which they could be derived. The number of environments in the cohort is the only count on the surface. No customer is identifiable either: cohort rows are anonymized, and their labels are assigned after the rows are sorted, so a label carries nothing the percentages do not already show. A product is named only when it has been seen across more than one independent customer.
Provenance is split, and stated. CVE identifiers, scores and descriptions are NVD's; known-exploited status, its dates and the ransomware-campaign flag are CISA's. Mapping observed software to those records, and the exposure findings that follow, are Mimic's own analysis and should not be attributed to either.
Related reading: The Patch Window, The Server Threat Library, and The Exploit Path.
Findings are assessed from software observed on the production servers Mimic monitors, aggregated across them, and published as percentages only — never traceable to a single customer. Vulnerability records come from NVD, from CISA's Known Exploited Vulnerabilities catalog, and, for the Windows half, from Microsoft's published security update guide. The live view is updated as the assessment and those public catalogs are refreshed. This product uses the NVD API but is not endorsed or certified by the NVD.