Rapid7: Attackers Weaponize High-Severity Flaws Within Three Days of Disclosure

Organizations relying on monthly patching schedules face heightened risk as attackers weaponize critical software flaws with unprecedented speed. A report from Rapid7 indicates that defenders must adapt to an environment where high-severity vulnerabilities are packaged into exploits within days, not weeks, of their public disclosure.

The cybersecurity firm’s Quarterly Threat Landscape report for the third quarter of 2026 recorded 43 newly exploited vulnerabilities. This figure represents a 19% increase compared to the same period last year. However, Douglas McKee, director of vulnerability intelligence at Rapid7, cautioned against viewing this as a steady climb in overall exploitation rates.

The Speed of Exploitation

McKee noted that the volume of new high-severity Common Vulnerabilities and Exposures, rated between 7 and 10, surged by 133% year-over-year. Publicly available proof-of-concept code also increased by approximately 86% during this period. This suggests that the pool of potentially exploitable flaws is growing much faster than the specific subset attackers choose to target.

Rapid7 data shows that attackers exploited these select high-severity flaws within an average of three days. Seventy-one percent of the tracked exploitation events landed within one week of the vulnerability becoming public. McKee stated that defenders have roughly 72 hours before a new high-severity flaw is used in the wild.

Targeting Unauthenticated Access

Attackers are increasingly selective, focusing on a narrow range of critical vulnerabilities that offer easy access. Nearly 80% of the vulnerabilities exploited in the third quarter could be reached remotely without requiring any login credentials. These flaws also required little to no user interaction, meaning victims did not need to click on malicious links or open attachments.

Commercial Repackaging of Known Flaws

The rapid adoption of these exploits appears driven by commercial repackaging rather than novel zero-day discoveries. Most underground forum posts referenced CVEs already listed in vendor advisories or the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. These references appeared within days of the initial disclosure, according to Rapid7.

McKee observed that AI tooling is surfacing flaws faster than teams can triage them. However, adversaries remain picky about which vulnerabilities they weaponize. He warned that organizations maintaining monthly patching cadences are defending against adversaries who have long abandoned such slow schedules.

Our take on the response

The shift toward remote, unauthenticated exploits fundamentally changes the risk calculus for IT teams. The 72-hour window for exploitation is too short for traditional, batched update processes. Security teams must prioritize vulnerabilities that allow remote code execution without authentication, as these present the highest immediate risk.

For customers and users

Users should verify that their devices and applications are running the latest software versions provided by vendors. Check whether your organization has a process for applying critical security updates immediately upon release, rather than waiting for scheduled maintenance windows. Be alert for phishing attempts that claim to address recent security alerts, as attackers often use known vulnerabilities to spread malware. Monitor account activity for unusual logins or changes to settings, which may indicate unauthorized access through unpatched systems.

What to do and how to stay safe: Rapid7

• Prioritize patching for vulnerabilities that allow remote access without authentication, as these are the most frequently targeted.
• Review your patching schedule to ensure critical updates are applied within days of release, not months.
• Monitor network logs for unusual inbound connections to systems that have not yet been updated with recent security fixes.
• Verify that security tools are configured to detect exploitation attempts against known high-severity vulnerabilities.

Step-by-step guide: Incident Response Plans: How to Stop Damage When Attacks Happen

General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How quickly are attackers exploiting new vulnerabilities?

Attackers exploited select high-severity flaws within an average of three days, with 71% of exploitation occurring within one week.

What types of vulnerabilities are attackers targeting?

Attackers favor remote exploits that require no authentication and little to no user interaction, with nearly 80% of exploited flaws fitting this profile.

Are attackers using new zero-day vulnerabilities?

Rapid7 indicates that most exploitation involves rapid commercial repackaging of known flaws already in vendor advisories or the CISA KEV catalog.