Rapid7: Attackers Exploit High-Severity Flaws Within Three Days of Disclosure

Rapid7 reported that attackers exploited high-severity vulnerabilities an average of three days after public disclosure in the third quarter of 2026. The firm’s Quarterly Threat Landscape Report indicates that 71% of tracked exploitation events occurred within the first seven days of a flaw becoming known to the public.

This rapid timeline challenges organizations that rely on fixed patching schedules to manage risk. Security teams face increasing difficulty reducing exposure when attackers can compromise systems before the next remediation window opens. The data highlights a narrowing window between vulnerability publication and active abuse in the wild.

Exploitation Trends and Volume

Rapid7 tracked 43 newly exploited high- and critical-severity vulnerabilities during the third quarter of 2026. This figure represents a 7% decrease from the second quarter but remains 19% higher than the same period in the previous year. While the volume of exploited flaws is not growing at the same rate as disclosures, the speed of exploitation has become the primary concern for defenders.

The report found that 80% of tracked exploitation occurred within 14 days and 90% within 30 days. These statistics underscore the limitations of relying solely on CVSS scores or theoretical severity ratings. Defenders must distinguish between vulnerabilities that pose an immediate, exploitable risk and those that remain theoretical threats to prioritize effectively.

Attack Characteristics and AI Usage

A significant portion of the exploited vulnerabilities required minimal effort to abuse. Of the 43 newly exploited high- and critical-severity flaws, 34 required no authentication or user interaction. This means attackers could access exposed systems without stolen credentials or malicious content interaction, making internet-facing services particularly vulnerable to immediate compromise.

Artificial intelligence also played a growing role in attack operations. Rapid7 noted that 8% of threat reporting in Q3 cited AI as an operational component. Threat actors used AI for technique selection, target assessment, and adapting to failed attack steps, while human operators continued to select targets and define objectives. This shift suggests a move toward AI supporting tactical decisions rather than just drafting content.

What should you do?

Security teams should prioritize visibility into externally accessible systems to identify exposures that require no authentication. Organizations must contextualize vulnerability data by distinguishing between theoretically severe flaws and those actively being exploited in the wild. Monitoring for unusual behavior may be more effective than relying exclusively on known malware signatures, given the increasing use of AI in attacks.

What to do and how to stay safe: Rapid7

• Map internet-facing assets to identify systems exposed to unauthenticated attacks.
• Prioritize remediation of vulnerabilities with active exploitation indicators over theoretical severity scores.
• Monitor for behavioral anomalies rather than relying solely on signature-based detection methods.
• Review patching cycles to ensure critical exposures are addressed within the first week of disclosure.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How quickly are attackers exploiting new vulnerabilities?

Attackers exploited high-severity vulnerabilities an average of three days after public disclosure in Q3 2026.

Do most exploited vulnerabilities require user interaction?

No, 79% of the 43 newly exploited high- and critical-severity vulnerabilities required no authentication or user interaction.

Is AI being used in cyberattacks?

Yes, 8% of threat reporting in Q3 cited AI as an operational component for tactical decisions and execution.