Rapid7: High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3

Rapid7’s third-quarter 2026 threat analysis reveals that attackers are exploiting high-severity vulnerabilities with unprecedented speed, averaging just three days from public disclosure to active exploitation. This data highlights the rapid pace at which malicious actors act on newly disclosed security flaws.

Seventy-one percent of these high-severity flaws were exploited within the first seven days of their disclosure, according to the report. The majority of these vulnerabilities are classified as “holy grail” flaws, meaning they can be exploited remotely without requiring credentials or local user interaction, making them particularly dangerous for unpatched systems.

The State of Ransomware and AI

Ransomware continues to dominate the threat landscape, with business services, manufacturing, and healthcare sectors facing the highest volume of attacks in the third quarter. The United States remains the most targeted nation globally, accounting for 60 percent of all attacks, followed by Germany at 7 percent, and Italy and Canada each at 5 percent.

The Gentlemen and Qilin emerged as the most successful ransomware groups during this period, claiming 342 and 339 incidents respectively. INC Ransom ranked third with 99 claims, while DeadLock and Krybit followed with 98 and 95 incidents each, highlighting the continued proliferation of active ransomware operations.

AI Adoption in Cyberattacks

Despite widespread speculation about autonomous AI-driven attacks, Rapid7’s data shows that artificial intelligence served as an operational component in only 8 percent of tracked incidents. Douglas McKee, director of vulnerability intelligence at Rapid7, noted that this figure contradicts the narrative of fully autonomous AI attackers dominating the threat landscape.

The report emphasizes that human operators still determine attack targets and motivations in every documented case. However, automation is increasing in the tactical middle of the attack chain, including technique selection, target triage, and recovery from failed steps, allowing attackers to operate with less direct human involvement.

Sector and Government Impact

Government sector victims of ransomware saw a 15 percent increase compared to the previous quarter, with the United States accounting for 45 percent of these attacks, up from 33 percent in the second quarter. This shift reflects a growing share of government sector attacks focused on the US.

As Threat Times reported on October 21, 2026, attackers are consistently exploiting high-severity flaws within days of disclosure, a trend that continues to challenge organizational security postures. The rapid exploitation timeline suggests that organizations must remain vigilant in monitoring for new vulnerabilities.

What should you do?

Organizations should prioritize patching high-severity vulnerabilities immediately upon disclosure, given the three-day average exploitation window. Security teams should also monitor for signs of ransomware activity, particularly in business services, manufacturing, and healthcare sectors, which remain primary targets.

What to do and how to stay safe: Rapid7

• Implement automated patch management systems to reduce the time between vulnerability disclosure and remediation.
• Conduct regular threat hunting exercises to detect early signs of ransomware activity or unauthorized remote access.
• Review and update incident response plans to address the increasing use of automation in attack chains.
• Monitor government sector communications for emerging threats, as this area sees rising ransomware targeting.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How quickly are high-severity vulnerabilities being exploited?

High-severity vulnerabilities are exploited within an average of three days from disclosure, with 71 percent compromised within the first seven days.

Which sectors are most targeted by ransomware?

Business services, manufacturing, and healthcare were the most targeted sectors in Q3 2026, with the US facing the highest number of attacks globally.

Is AI playing a major role in cyberattacks?

AI appeared in only 8 percent of tracked incidents as an operational component, with human operators still directing attack strategies and target selection.