Source: Rapid7 Cybersecurity Blog
Author: Rapid7 Intelligence
URL: https://www.rapid7.com/blog/post/tr-q3-2026-threat-update-attackers-exploiting-vulnerabilities-within-3-days
ONE SENTENCE SUMMARY:
Rapid7’s Q3 2026 report shows attackers exploit severe vulnerabilities within days, favor unauthenticated paths, increasingly use AI, and monetize access.
MAIN POINTS:
- Average time from disclosure to exploitation was three days for high-severity vulnerabilities.
- 71% of observed exploitation happened within the first seven days after publication.
- Rapid7 tracked 43 newly exploited high/critical vulnerabilities, 7% fewer than Q2.
- Year-over-year, newly exploited vulnerabilities were 19% higher for the same period.
- Speed, not volume, is the primary risk: exploitation outpaces typical patching windows.
- 80% of tracked exploitation occurred within 14 days; 90% within 30 days.
- 79% of exploited vulnerabilities required no authentication or user interaction.
- Internet-facing services with reachable flaws demand immediate, context-based remediation prioritization.
- 8% of threat reporting cited AI as an operational component in attack execution.
- Underground forums showed 41 posts advertising RDP or network access for sale.
TAKEAWAYS:
- Shift from fixed patch cycles to rapid response for actively exploited disclosures.
- Favor prioritization using exploitability and reachability rather than CVSS alone.
- Reduce exposure by mapping external attack surface and unauthenticated entry points.
- Strengthen compensating controls and detection where immediate remediation is impossible.
- Prepare for AI-assisted adversaries by monitoring behavior changes beyond signature-based detection.