8,539 Reasons To Rethink How Vulnerabilities Get Patched
Rapid7 counted 8,539 high and critical CVEs in Q2 2026, double last year, with PoC availability up 76%.
Rapid7's Q2 2026 Threat Landscape Report tallied 8,539 high- and critical-severity vulnerability disclosures, twice the number recorded in Q2 2025, with newly disclosed flaws having public proof-of-concept code up 76% year over year. Of newly exploited vulnerabilities, 62% were network-exploitable and required neither authentication nor user interaction. Fake CAPTCHA and ClickFix social engineering accounted for 31.8% of incident response cases, the United States recorded 881 listed ransomware victims, and APT28 exploited SOHO routers for DNS hijacking while Iranian groups targeted US industrial control and OT systems.
- Exploit-to-weaponization gap after disclosure has collapsed to near zero
- APT28 exploited small office and home office routers for DNS hijacking
- Social engineering activity expanded into Microsoft Teams
- US recorded 881 ransomware victims; business services and healthcare top-targeted
- Recommends MFA and credential rotation on internet-facing SSL-VPN and RDP paths
- Vendors
- Rapid7
- Threat actors
- APT28
- Organizations
- CISARapid7 Labs
- Countries
- United StatesGermanyIndiaThailand
From the original article
3 min read at helpnetsecurity.com
The window for responding to newly disclosed security flaws is getting shorter. Exploit code can appear quickly, exploitability can be tested soon after disclosure, and organizations have a growing number of weaknesses to sort through. Rapid7’s Q2 2026 Threat Landscape Report counted 8,539 high- and critical-severity vulnerability disclosures , twice the number recorded a year earlier.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.