Rapid7 Q3 2026 Report: High-Severity Vulnerabilities Exploited in Three Days on Average

On October 21, Rapid7 released its Q3 2026 report, which found that the high-severity vulnerabilities it analyzed were exploited three days after disclosure on average. In that dataset, 71% of cases happened in the first week. That is a strong reason to assess your exposure right away rather than wait for the monthly patch window.

Key findings

The report draws on vulnerability research, incident response work and monitoring of the cybercrime underground. Its findings describe this research sample only. Three days is not a deadline by which every new vulnerability will be exploited, and it doesn’t mean you are safe for the first three days.

Rapid7 also points to what the analyzed vulnerabilities had in common: many could be exploited remotely, with no credentials and no action from a local user. For administrators, that means quickly working out which vulnerable services attackers can actually reach.

Ransomware and the role of AI

The report still names ransomware as a major threat. Leak-site numbers need care, though. A claim posted by a ransomware group is not automatically a confirmed incident, and the number of posts is not the same as the number of distinct victims.

According to Rapid7, artificial intelligence played an operational role in 8% of the reports it tracked. The authors stress that humans still choose the targets and decide what an attack is meant to achieve. This data can’t be used to estimate how much AI is involved in cyberattacks overall.

What organizations should change

• Set up a fast-track process for assessing new vulnerabilities in internet-facing services.
• Pair technical severity ratings with the system’s real configuration and how reachable it is.
• When a patch is deferred, name a risk owner, set a deadline and restrict access in the meantime.
• After patching, confirm the installed version and look for signs that the vulnerability was exploited earlier.

SecurHUB’s take

The report supports setting priorities based on how likely a breach is and what it would cost the business. A 24/7 SOC can help monitor at-risk services and check suspicious activity while patches are rolled out.

Sources: Rapid7 — report announcement, SecurityWeek