CriticalRansomware
Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days
Rapid7·Source published ·1 min read
What happened?
Three days is the average time between a high-severity vulnerability becoming public and its exploitation, according to the latest Quarterly Threat Landscape Report from Rapid7. And 71% of the exploitation tracked in Q3 occurred within the first seven days. For security teams already managing growing vulnerability backlogs, this creates a difficult question: How do you reduce exposure when attackers can exploit vulnerabilities before your next patching window?
Key details
- Average exploitation occurs three days after public disclosure of high-severity vulnerabilities.
- Seventy-one percent of tracked exploitation happened within the first seven days of disclosure.
- Eighty percent of exploitation occurred within 14 days and 90% within 30 days.
- Rapid7 tracked 43 newly exploited high- and critical-severity vulnerabilities in Q3 2026.
- Seventy-nine percent of exploited vulnerabilities required no authentication or user interaction.
- Eight percent of threat reporting cited AI as an operational component in attacks.
- Underground forums showed 41 posts advertising RDP or network access to compromised environments.
What to look for
- AI assistance used for technique selection, target assessment, and adapting failed attack steps.
- Threat actors splitting malicious objectives across multiple AI sessions to evade safeguards.
- Underground forum posts advertising RDP or network access to compromised environments.
Summarised by SecOraLens from Rapid7. Always read the original source before acting. How SecOraLens verifies advisories.