Microsoft’s critical vulnerability remains unpatched in hundreds of thousands of computers, and it may already be exploited in secret.