Rapid7 Q3 2026 Report Finds Vulnerabilities Exploited in Three Days on Average
Summary
Rapid7’s Q3 2026 report says newly disclosed high- and critical-severity vulnerabilities were exploited in three days on average. It also highlights unauthenticated vulnerabilities, operational AI use in attacks, and posts selling RDP or network access.
Key points
- Rapid7 tracked 43 newly exploited high- and critical-severity vulnerabilities in Q3, with exploitation occurring three days after public disclosure on average.
- 71% of tracked exploitation occurred within seven days; 80% occurred within 14 days and 90% within 30 days.
- Of the 43 vulnerabilities, 34 (79%) required no authentication or user interaction.
- AI appeared as an operational component in 8% of Rapid7’s tracked threat reporting; reported uses included technique selection, target assessment, and adapting when attack steps failed.
- Rapid7 identified 41 underground-forum posts advertising RDP or network access.
- The report advises prioritizing externally accessible assets, known exploitation, unauthenticated access paths, and critical business systems, with compensating controls and detection coverage where immediate remediation is not possible.
Article Details
- Publisher
- Rapid7
- Report Period
- Q3 2026
- Scope
- Vulnerability exploitation timelines, AI use in attacks, ransomware activity, APT tracking, and underground forum intelligence.
- Sample Size
- 43 newly exploited high- and critical-severity vulnerabilities tracked; 41 underground forum posts advertising RDP or network access identified.
- Key Statistics
- Average time from public disclosure of a high-severity vulnerability to exploitation: 3 days.
- 71% of tracked exploitation occurred within 7 days; 80% within 14 days; 90% within 30 days.
- 34 of 43 newly exploited high- and critical-severity vulnerabilities (79%) required no authentication or user interaction.
- Newly exploited high- and critical-severity vulnerabilities were down 7% from Q2 but 19% higher than the same period last year.
- AI was cited as an operational component in 8% of threat reporting tracked in Q3.
- Recommendations
- Identify externally accessible assets and the vulnerabilities affecting them.
- Prioritize known exploitation, unauthenticated access paths, and systems supporting critical business functions.
- Where immediate remediation is not possible, assess compensating controls and detection coverage.
- Monitor attacker behavior and adapt detection rather than relying exclusively on known malware signatures or threat actor identities.