71% of vulnerability exploitation starts within a week of disclosure
Attackers are exploiting newly disclosed security flaws within days, leaving organizations little time to respond, according to Rapid7’s Q3 2026 Quarterly Threat Landscape Report. The company reported an average of three days between public disclosure and exploitation of high-severity vulnerabilities, with 71% of tracked exploitation occurring within the first week.
Cumulative exploitation rate (Source: Rapid7)
Exploitation puts pressure on fixed patching schedules
Researchers tracked 43 newly exploited high- and critical-severity vulnerabilities during the quarter. Organizations relying on fixed remediation schedules are under pressure to distinguish vulnerabilities with high severity ratings from those posing an immediate, exploitable risk.
Of those 43 vulnerabilities, 34 required neither authentication nor user interaction to exploit, giving attackers potential entry points into exposed systems.
A CVSS score alone cannot tell security teams which systems are externally accessible, which vulnerabilities are being actively exploited, or whether existing controls can prevent or limit a compromise.
State-linked groups target government and industry
Rapid7 linked 15 known software vulnerabilities to six threat actors or clusters during the quarter. Targeted sectors included government, defense, aerospace, transportation, finance, energy, healthcare, and technology.
A North Korea-linked toolkit was used against South Korean automotive and media organizations, likely beginning in early 2025. It combined a backdoor in modified HAProxy software with an SSH keylogger and a remote access tool.
Russia-linked Void Blizzard has targeted organizations in NATO countries and Ukraine, while Pakistan-linked Operation C-Major has targeted Indian government and military personnel.
AI appeared as an operational component in 8% of the threat reporting researchers tracked. In documented cases, humans continued to choose targets and objectives, while AI assisted with tactical decisions and execution. Some attackers split malicious objectives across multiple AI sessions to evade safeguards.
“Board decks often confuse the real explosion in AI-driven vulnerability discovery with actual exploitation, which hasn’t materialized. Only 8% of tracked reporting cites AI as an operational component,” said Christiaan Beek, Vice President of Rapid7 Intelligence.
U.S. share of government ransomware incidents grows
Government-sector ransomware incidents among the top 10 reporting countries increased from 48 in the second quarter to 55 in the third, a 15% rise. The U.S. share grew from 33% to 45%, with incidents increasing from 16 to 25.
Across all sectors, 1,112 U.S. ransomware leak-site listings were recorded. In its overall group rankings, The Gentlemen led with 342 listings, followed by Qilin with 339 and INC Ransom with 99.
Access sales dominate underground posts
Of 63 underground posts monitored during the quarter, 41 advertised Remote Desktop Protocol or network access.
Another 14 involved selling, sharing, or discussing exploits or purported zero-days. Most referenced known vulnerabilities already covered by vendor advisories or CISA’s Known Exploited Vulnerabilities catalog, indicating rapid commercial repackaging of disclosed flaws.
