Attackers take three days on average to exploit new flaws, Rapid7 finds
Most of the high-severity flaws newly exploited in the third quarter needed no login or user action, and human operators rather than AI agents still chose the targets, according to the security vendor’s own data
- Of the 43 newly exploited flaws, 34 (79%) needed no authentication or user interaction
- The Gentlemen posted 342 ransomware leak-site listings, Qilin 339 and INC Ransom 99
- Rapid7 counted 1,112 ransomware listings for US organizations, roughly eight times the figure for Germany
- Of 63 underground posts tracked, 41 advertised Remote Desktop Protocol (RDP) or network access
Internet-facing systems carry most of the risk in Rapid7’s data, including edge appliances such as F5’s BIG-IP APM, a flaw in which was the subject of a criminal forum thread three days after disclosure. Business services, manufacturing and healthcare firms were the most listed ransomware victims, and Rapid7 says weekly or monthly patch cycles are too slow for the window it measured. Its own prescription is to map externally accessible assets, put known-exploited and unauthenticated flaws first and, where a fix cannot go in at once, check compensating controls and detection coverage.
“Board decks often confuse the real explosion in AI-driven vulnerability discovery with actual exploitation, which hasn’t materialized.”Christiaan Beek, vice-president of Rapid7 Intelligence, Rapid7
Attackers exploited newly disclosed high- and critical-severity vulnerabilities an average of three days after they went public in the third quarter of 2026, according to Rapid7’s Quarterly Threat Landscape Report, published on 21 October. Rapid7, which sells managed detection and response (MDR) and vulnerability management, tracked 43 such flaws exploited for the first time in the quarter.
That count is 7% lower than in Q2 but 19% higher than a year earlier. Rapid7 found that 71% of the exploitation it tracked happened within seven days of disclosure, 80% within 14 days and 90% within 30. Disclosures are growing far faster than exploitation: the number of new high- and critical-severity vulnerabilities rose 133% year on year, the report shows.
The research also tests the idea that AI agents now run attacks. AI appeared as an operational component in 8% of the threat reporting Rapid7 tracked. In every documented case a human chose the target and the objective, while AI helped with technique selection, target assessment and recovery when an attack step failed. Rapid7 also describes attackers splitting a malicious request across several AI sessions to get past one AI provider’s safeguards, which had refused most of the same requests made in a single session.
Sellers of stolen access were the largest category of activity on the criminal forums Rapid7 monitors, offering anything from one hijacked account to a way into a whole corporate network.
Sources
- Rapid7, “Rapid7 Report: Human Operators Still Drive Most of Tracked Cyberattacks, but Exploitation Windows Are Narrow”, press release, 21 October 2026. https://www.rapid7.com/about/press-releases/rapid7-report-human-operators-still-drive-most-of-tracked-cyberattacks-but-exploitation-windows-are-narrow/
- Rapid7 Intelligence, “Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days”, blog post, 21 October 2026. https://www.rapid7.com/blog/post/tr-q3-2026-threat-update-attackers-exploiting-vulnerabilities-within-3-days/
- Rapid7, “Quarterly Threat Landscape Report: Q3 2026”, report, 21 October 2026. https://www.rapid7.com/research/report/quarterly-threat-landscape-report/
