Rapid7: Exploitation Now Averages Three Days After Disclosure

Past-week coverage · Original source published 2026-10-21.

Rapid7's Q3 2026 Quarterly Threat Landscape Report puts the average gap between a high-severity vulnerability becoming public and its exploitation at three days. The vendor said 71% of the exploitation it tracked in the quarter happened within the first seven days, 80% within 14 days and 90% within 30 days.

The report counted 43 newly exploited high- and critical-severity vulnerabilities, down 7% from Q2 but 19% higher than the same period a year earlier. Rapid7 argues the more pressing problem is speed rather than volume: disclosure counts are not rising as fast as the rate at which attackers act on the vulnerabilities they pick.

Of those 43, Rapid7 said 34, or 79%, required no authentication or user interaction. That matters for internet-facing services, where an attacker can reach the vulnerable system without stolen credentials or a lure.

Rapid7 also said 8% of the threat reporting it tracked cited AI as an operational component, used for technique selection, target assessment and adapting when a step failed, while human operators still chose targets and objectives. Its advice: find externally reachable assets, prioritize known exploitation and unauthenticated paths, and check compensating controls where patching can't happen immediately.