Last year, 49% of all Microsoft vulnerabilities could cause elevation of privilege, the report found.

Turning to the 326 remote code execution vulnerabilities reported in 2021, 35 had a CVSS score of 9.0 or higher.

Also, Internet Explorer and Edge vulnerabilities soared to a record high of 349, approximately four times the 2020 figure.

"Microsoft's move to the Common Vulnerability Scoring System (CVSS), now makes it easier for vulnerabilities to be cross-referenced with third-party applications that leverage affected services," said BeyondTrust chief security officer Morey Haber.

"However, this is a trade-off because of the loss of visibility to determine the impact of administrative rights on critical vulnerabilities. What is clear, is the continued risk of excessive privileges. With the growing risk of privileged attack vectors caused by cloud deployments, the removal of admin rights remains a critical step to reduce an organisation's risk surface. This can be achieved by adopting a least privilege strategy and enabling zero-trust architectures throughout an environment."

According to BeyondTrust, the consistently high volume of Microsoft vulnerabilities means ensuring endpoint security is critical, and removing of administrative rights is an essential mitigation for many risks.

BeyondTrust Endpoint Privilege Management enables organisations to achieve least privilege while balancing security and productivity, the company claims.

The 2022 Microsoft Vulnerabilities Report can be downloaded here.