Rapid Exploit Timelines Put Remote, Zero-Click Vulnerabilities First
Attackers aren’t trying to exploit every newly disclosed flaw. Rapid7’s latest quarterly findings point to a narrower, faster pattern: adversaries select vulnerabilities that are easy to reach and quick to weaponize, often within days. For security teams, that makes exposure and exploitability better guides for patch order than a monthly schedule.
Rapid7’s Quarterly Threat Landscape report counted 43 newly exploited vulnerabilities in Q3 2026, a 19% increase from a year earlier. But that figure tells only part of the story. High-severity CVEs, rated 7 to 10, rose 133% year over year, while publicly available proof-of-concept code increased by about 86%.
Douglas McKee, Rapid7’s director of vulnerability intelligence, cautioned against reading the exploitation increase as a “slow, steady climb.” The pool of flaws that could be attacked is expanding much faster than the group attackers actually choose to exploit.
Known flaws move quickly into circulation
Rapid7 found that most underground forum posts referred to CVEs that had already appeared in vendor advisories or the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. Many surfaced within days of disclosure, suggesting that sellers are quickly repackaging known vulnerabilities rather than offering a surge of novel zero-day exploits.
McKee said AI tools can help surface flaws faster than security teams can triage them, but attackers remain selective about what they weaponize. Rapid7’s tracked attacks targeted chosen high-severity vulnerabilities after an average of three days; 71% took place within a week. Flaws that allow remote access without authentication or meaningful user interaction are especially attractive.
“Once a new high-severity flaw goes public, you’ve got roughly 72 hours before someone is using it in the wild, and attackers aren’t casting a wide net while they do it,” McKee said. That pace puts pressure on defenders to rethink vulnerability management around shorter exposure windows.
Prioritize systems attackers can reach
Nearly 80% of the vulnerabilities Rapid7 saw exploited during the quarter were remotely reachable, required no login and needed no action from the victim. That profile gives security leaders a practical way to focus their response: find systems exposed to remote, unauthenticated, zero-click attacks, then decide how many days of exposure each system can tolerate.
“If your patching cadence still has the word ‘monthly’ in it, you’re defending against an adversary who abandoned that schedule a long time ago,” McKee warned. The implication isn’t that every fix can be deployed immediately. It’s that a fixed calendar may leave the most exposed systems waiting while attackers move within a matter of days. Risk-based prioritization can help teams decide what to patch first based on the systems they run and the ways those systems are exposed.
AI use remains a smaller share of observed attacks
Security leaders are more concerned about AI-enabled attacks than Rapid7’s observations alone might suggest. Foundry, CSO’s parent company, reported that 45% of CISOs rated the threat a high concern in its forthcoming Security Priorities report. Rapid7, by comparison, identified AI as an operational component in about 8% of the attacks it tracked.
In those cases, McKee said, AI helped manage the tactical middle of an attack, such as selecting the next technique or assessing which targets were worth the effort. “It wasn’t deciding who to go after or why. A human still made that call.”
UnderDefense CEO Nazar Tymoshyk offered a more forward-looking warning. He said Russian APT groups are already conducting AI-powered attacks, often using Chinese models such as DeepSeek and switching between models during an operation. Agentic tools, he argued, can give attackers access to a broader mix of skills—including database administration and CI/CD expertise—than a conventional human team might readily assemble.
The near-term signal is clear: fast exploitation is concentrated on flaws that offer direct, low-friction access. Security teams can use that profile to identify their highest-risk exposure and set patch deadlines that reflect how quickly attackers are acting.
