Rapid7 Report: 71% of Vulnerability Exploitation Occurs Within a Week of Disclosure
Attackers are exploiting high-severity vulnerabilities within an average of three days of public disclosure, with 71% of tracked exploitation occurring within the first week, according to Rapid7's Q3 2026 Quarterly Threat Landscape Report.
Attackers are demonstrating an alarming speed in exploiting newly disclosed security flaws, leaving organizations with a rapidly shrinking window for response. Rapid7's Q3 2026 Quarterly Threat Landscape Report highlights that, on average, it takes just three days between the public disclosure of a high-severity vulnerability and its exploitation in the wild. This aggressive timeline means that a staggering 71% of all tracked exploitation incidents occur within the first week following disclosure.
This trend is placing immense pressure on organizations that rely on traditional, fixed patching schedules. The report tracked 43 newly exploited high- and critical-severity vulnerabilities during the third quarter of 2026. Security teams are finding it increasingly difficult to differentiate between vulnerabilities that are merely rated as high-severity and those that pose an immediate, exploitable risk to their external-facing systems. The CVSS score alone is insufficient, as it does not indicate whether a system is externally accessible, if a vulnerability is actively being exploited, or if existing security controls can effectively mitigate the threat.
Further exacerbating the challenge, a significant portion of these exploited vulnerabilities require minimal barriers to entry. Of the 43 vulnerabilities tracked, a substantial 34 did not require authentication or any user interaction to be exploited. This means that attackers can potentially gain unauthorized access to exposed systems without needing credentials or tricking users into performing specific actions, significantly broadening the attack surface.
The report also sheds light on the activities of state-linked threat actors, who continue to target government and critical industry sectors. Rapid7 linked 15 known software vulnerabilities to six distinct threat actors or clusters during the quarter. The sectors most frequently targeted included government, defense, aerospace, transportation, finance, energy, healthcare, and technology. Notably, a toolkit attributed to North Korea was used against South Korean automotive and media organizations, likely beginning in early 2025, combining a backdoor in modified HAProxy software with an SSH keylogger and a remote access tool.
Artificial intelligence is beginning to play a more prominent role in threat landscapes, though its application in exploitation is still nascent. AI appeared as an operational component in 8% of the threat reporting tracked by Rapid7. In these documented cases, human operators still defined the targets and objectives, while AI assisted with tactical decisions and execution. Some attackers have even been observed splitting malicious objectives across multiple AI sessions to circumvent built-in safeguards. Christiaan Beek, Vice President of Rapid7 Intelligence, noted that "Board decks often confuse the real explosion in AI-driven vulnerability discovery with actual exploitation, which hasn’t materialized. Only 8% of tracked reporting cites AI as an operational component."
The report also observed a concerning increase in government-sector ransomware incidents, particularly in the United States. Incidents among the top 10 reporting countries rose by 15% from the second to the third quarter, from 48 to 55. The U.S. share of these incidents grew from 33% to 45%, with the number of incidents increasing from 16 to 25. Across all sectors, 1,112 U.S. ransomware leak-site listings were recorded, with The Gentlemen, Qilin, and INC Ransom being the most prolific groups.
Underground forums continue to be a marketplace for initial access, with access sales dominating monitored posts. Of 63 underground posts monitored during the quarter, 41 advertised Remote Desktop Protocol or network access. Another 14 involved the sale, sharing, or discussion of exploits or purported zero-days. The report indicates that many of these offerings are rapid commercial repackagings of vulnerabilities that have already been disclosed and are often covered by vendor advisories or CISA's Known Exploited Vulnerabilities catalog.
This comprehensive report underscores a critical shift in the threat landscape: the acceleration of exploitation post-disclosure. Organizations must move beyond traditional patching cadences and adopt more dynamic, risk-based approaches to vulnerability management to effectively defend against increasingly agile adversaries.