Rapid7: high-severity flaws exploited three days after disclosure
Original title: Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days
Of 43 newly exploited high- and critical-severity bugs in Q3, 34 needed no authentication or user interaction.
Rapid7’s Q3 2026 Quarterly Threat Landscape Report says the average time from public disclosure of a high-severity vulnerability to exploitation was three days. Of exploitation it tracked, 71% occurred within seven days, 80% within 14 days, and 90% within 30 days. It tracked 43 newly exploited high- and critical-severity vulnerabilities, down 7% from Q2 but 19% above the same period last year. Eight percent of tracked threat reporting cited AI as an operational component.
Unconfirmed: Counts and timelines reflect Rapid7’s tracked sample, not all public disclosures.
- Thirty-four of the 43 flaws required no authentication or user interaction.
- Humans still picked targets; AI aided technique choice, assessment, and failed-step adaptation.
- The report says actors split objectives across AI sessions to evade provider safeguards.
- Underground monitoring found 41 posts advertising RDP or network access.
Impact: Unauthenticated exploitation of newly disclosed high-severity flaws
- 1.Identify externally accessible assets and the vulnerabilities affecting them.
- 2.Prioritize known exploitation, unauthenticated paths, and critical business systems.
- 3.Where patching is delayed, assess compensating controls and detection coverage.
- Vendors
- Rapid7
From the original article
3 min read at rapid7.com
Three days is the average time between a high-severity vulnerability becoming public and its exploitation, according to the latest Quarterly Threat Landscape Report from Rapid7. And 71% of the exploitation tracked in Q3 occurred within the first seven days.
By Rapid7 Intelligence · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.