Rapid7 says 71% of tracked exploitation starts within a week
Original title: 71% of vulnerability exploitation starts within a week of disclosure
Across 43 newly exploited high- and critical-severity flaws, disclosure-to-exploitation averaged three days.
Rapid7’s Q3 2026 threat report says attackers are exploiting newly disclosed high-severity flaws within days. Of 43 tracked vulnerabilities, 34 needed neither authentication nor user interaction. The report also links 15 vulnerabilities to six actors, notes AI in 8% of tracked threat reporting, and records rising government ransomware listings and underground sales of remote access.
Unconfirmed: Leak-site totals reflect listings, and the North Korea activity’s early-2025 start is described as likely.
- A North Korea-linked toolkit targeted South Korean automotive and media organizations.
- Government ransomware cases in the top 10 countries rose from 48 to 55.
- The US share grew from 16 incidents to 25, or 33% to 45%.
- Across sectors, Rapid7 recorded 1,112 US ransomware leak-site listings.
- The Gentlemen had 342 listings, Qilin 339 and INC Ransom 99.
- Organizations
- Rapid7
From the original article
2 min read at helpnetsecurity.com
Attackers are exploiting newly disclosed security flaws within days, leaving organizations little time to respond, according to Rapid7’s Q3 2026 Quarterly Threat Landscape Report. The company reported an average of three days between public disclosure and exploitation of high-severity vulnerabilities, with 71% of tracked exploitation occurring within the first week.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.