The Acronis Threat Research Unit analyzed anonymized telemetry from more than 1.8 million business computers protected by its products that were online on September 30, 2026. In the report, "PC" means any Windows machine, servers included. The main finding isn't that clutter causes breaches. It's that ordinary apps stay installed long after anyone needs them, unsupported products can never be fixed, and available security updates for everyday tools often go uninstalled for weeks, months or years.
Before the numbers, two caveats. First, this is Acronis looking at its own customers. It isn't a census of every business PC, and the report doesn't publish enough methodology for anyone to reproduce it. Second, Acronis says plainly that its findings "describe computers, not breaches." A pending update shows exposure, not proof that anyone was attacked.
How much is in the drawer
According to Acronis, the average Windows PC in its dataset has 38 apps, and 22.3% have more than 50. Acronis calls that count a likely minimum, because it only includes software that registers itself in the normal way.
- Install age: Windows records an install date for about six in ten apps. Of those, 25.6% were installed more than three years ago, and 46.7% of Windows PCs have at least one app that old.
- Untouched records: 2.6% of Windows PCs (more than 45,000 machines) have an app whose record hasn't changed in two years or more. Acronis warns that about four in five of those records were never checked by a full software scan, so the real share may be lower.
- Late removals: Windows apps removed in Q3 2026 had been installed for 677 days on average. 46.3% had been there more than a year and only 35.1% were removed within 90 days. Macs were nearly the reverse: a 261-day average, with 68.3% of removed apps gone within 90 days. Acronis suggests Mac apps are simply easier to delete, but it doesn't prove that.
Most of the untouched-for-years list is harmless plumbing: Visual C++ redistributables, Intel and Realtek drivers, Microsoft Update Health Tools, SQL Server connectors. Mixed in with it, though, are tools that people chose to install: WinRAR, 7-Zip, Java and Zoom. Acronis also found the Mozilla Maintenance Service unchanged for more than two years on 0.49% of Windows PCs. That service helps Firefox update itself in the background, so if it hasn't moved, check whether Firefox has.
Section summary: Most of the clutter is background components. The risk sits in a small group of apps that people installed on purpose and then forgot.
The real problem: updates that never get installed
Acronis had update-status data for only 41.5% of the Windows PCs it studied, so these figures apply only to that subset. It defines a "waiting update" as an application security update released more than 30 days ago that is still new, failed or waiting for a restart. Operating system updates are excluded.
- 22.1% of PCs with update data had at least one waiting app update, which Acronis says works out to 9.2% of all Windows PCs.
- 7.4% had a waiting update rated critical.
- Counting other Microsoft-released updates as well, 34.6% had something pending.
- On 77% of PCs with a waiting update, the missing fix addresses a weakness on CISA's Known Exploited Vulnerabilities (KEV) list. On 57.2%, that weakness has also been used in ransomware.
The apps most often waiting, as a share of PCs with update data:
| App | PCs with a waiting update | Of those, linked to a KEV-listed flaw |
|---|---|---|
| WinRAR | 5.3% | 99.6% |
| Java | 4.9% | 96.7% |
| Firefox | 4.5% | 87.1% |
| Notepad++ | 4.0% | 78.1% |
| 7-Zip | 3.8% | 62.5% |
Read the two columns separately. WinRAR's 5.3% is how many PCs (with update data) are waiting on a WinRAR update. The 99.6% is the share of those PCs where the missing update fixes a KEV-listed flaw.
Acronis specifically mentions WinRAR's CVE-2023-38831, and the record for that bug supports the concern. CVE-2023-38831 is in the CISA Known Exploited Vulnerabilities Catalog and is known to have been leveraged as part of a ransomware campaign. Group-IB found it, and Qualys reports that it had been under exploitation since April 2023, before it was discovered and reported to Rarlab. Rarlab released a beta patch on July 20 and WinRAR 6.23 on August 2, 2023, and CISA added it to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation on August 24, 2023. Born City noted at the time that groups such as Sandworm, APT28 and APT40 were exploiting it.
So a fixed WinRAR release has been available for more than three years. If Acronis's numbers hold, many business PCs still haven't installed fixes for flaws that attackers are known to use.
Browsers patch fast, everything else doesn't
Acronis also measured how long it took for app security updates installed in Q3 2026 to land after release. The overall median was six days, with 60.4% installed within a week and 90.7% within 30 days. That looks healthy until you break it out by app:
| App | Median days from release to install |
|---|---|
| Chrome | 4 |
| Firefox | 6 |
| 7-Zip | 10 |
| Notepad++ | 13 |
| Adobe Acrobat Reader / Zoom | 14 |
| WinRAR | 35 |
| UltraVNC | 63 |
| VLC | 71 |
| Java | 1,000 |
Apps that update themselves get fixed within days. Apps that need someone to act can wait months. The Java updates installed this quarter had been released a median of almost three years earlier, and remember that these are the PCs that eventually caught up.
Turning on patching helps, but it doesn't fix the problem by itself. Acronis says 22.4% of PCs with patching enabled still had a waiting update, compared with 31.3% of PCs that only scan. That's a correlation in the telemetry, not proof of cause. Acronis's own reading is that the updates aren't failing so much as never being installed, so approvals, maintenance windows and pending restarts are the places to look.
Remote-access tools deserve their own warning. Acronis found waiting updates for TeamViewer, TightVNC and UltraVNC, and nearly all the TightVNC and UltraVNC ones were rated critical. An outdated remote-control tool can give an attacker the same access as the PC's owner.
Section summary: The gap isn't about detecting missing patches. It's about who owns the small tools nobody manages and who actually approves their updates.
Software nobody will ever fix again
Acronis reports that 22.8% of Windows PCs have at least one product past end of support. These categories overlap, so don't add them up:
- Office 2016 and 2019: 9.8%. Microsoft Learn's lifecycle table confirms both reached end of support on October 14, 2025. After that date Microsoft provides no technical support, bug fixes or security fixes. The same table lists Office LTSC 2021 as ending October 13, 2026, which is next on the list.
- Silverlight: 5.4%
- SQL Server 2008/2012/2014 database engine: 4%
- Office 2007/2010/2013: 3%
- Adobe Acrobat/Reader 9, X, XI: 2.9%
- Flash Player: 1.8%
- Java 6/7: 1.2%
Acronis tracked Chrome 109 or older separately and left it out of the 22.8% total. Chrome 109 was the last release for Windows 7, 8 and 8.1, so it mostly signals an old operating system underneath. Acronis found it on 84% of Windows 7/8.x PCs.
For Office shops, Microsoft's upgrade guidance has concrete tools:
- Use Configuration Manager's Office 365 Client Management dashboard, or the Microsoft 365 Apps Upgrade Readiness Toolkit, to find machines still running Office 2016 or 2019.
- For Office 2019, enable the Group Policy setting Upgrade Office 2019 to Microsoft 365 Apps for enterprise, found under Computer Configuration\Administrative Templates\Microsoft Office 2016 (Machine)\Updates. Microsoft warns the switch can take several days because it depends on Office's update checks.
- Alternatively, build an upgrade package with the Office Deployment Tool and use the RemoveMSI element to remove older MSI-based installs.
Who has the fullest drawer?
By operating system. Windows 11 is much cleaner in Acronis's data:
| OS | Waiting update (PCs with data) | Waiting critical update | End-of-support product |
|---|---|---|---|
| Windows 11 | 18.9% | 5.9% | 17.0% |
| Windows 10 (22H2 and older) | 35.6% | 14.9% | 49.6% |
| Windows 7/8.x | 37.3% | 20.8% | 80.4% |
| Server 2016 | 26.5% | 8.1% | 40.9% |
| Server 2008/2012 | 35.2% | 13.1% | 67.0% |
This is a correlation, not proof that the OS version causes the backlog. More likely, machines nobody has refreshed also tend to have software nobody has refreshed.
By customer size. Customers with 1–10 computers had update data for only 35% of their PCs, end-of-support software on 26.6%, and two-year-untouched apps on 4.4%. For customers with 100 or more computers, those figures were 42%, 19.9% and 1.2%. PCs without update data ran unsupported products about as often as those with data (23.2% vs. 23.6%). Acronis admits it can't tell whether their patch backlog is just as large, because nobody can see it.
A reality check on the vendor framing
This is vendor research, and the report ends with a pitch for Acronis MDR and its EDR/XDR products. Read the recommendations on their merits, not as a product requirement. Nothing in the inventory, patching and removal steps below needs a specific vendor.
One claim needs a caveat: Acronis says Oracle ties Java 8 business updates to a paid subscription. Oracle's licensing has gone through several models and depends on the version and how it's used. Check the terms for your own Java distribution and use case before deciding whether to license it, replace it or remove it. Ignoring it is the only bad option.
The cleanup routine
Acronis's advice holds up and fits NIST's patch-management guidance (SP 800-40 Rev. 4). NIST describes patching as a process of identifying, prioritizing, acquiring, installing and verifying updates, and treats it as preventive maintenance rather than an occasional project.
- Inventory every PC. Treat a machine with no update data as an open finding, not as clean.
- Remove what can't be patched: Silverlight, Flash, Shockwave, old Acrobat and old Office versions. No update is coming for any of them.
- Fix KEV-listed flaws first. Start with WinRAR, Java, Firefox, Notepad++ and 7-Zip.
- Turn on third-party patching, not just scanning, and then check approvals, maintenance windows and stuck restarts.
- Remove remote-access tools when the job is done.
- Replace PCs that can't run a supported version of Windows.
- Repeat every few months, including updates that failed or are still waiting for a restart.
Whether you're an MSP with dozens of small clients or one admin running a 20-seat office, the drawer won't empty itself, and Acronis's data suggests attackers are already going through it.