Rapid7 Finds Attackers Exploit Select Vulnerabilities Within 72 Hours

Security teams have a shrinking window to respond to the vulnerabilities attackers actually choose. Rapid7 found that selected high-severity flaws were exploited in an average of three days in Q3 2026, with 71% of tracked exploitation occurring within a week.

The firm’s quarterly threat report counted 43 newly exploited vulnerabilities, a 19% increase year over year. But that rise doesn’t capture how quickly the pool of potential targets is expanding. New high-severity CVEs, rated 7 to 10, increased 133%, while public proof-of-concept code rose about 86% over the same period.

“The pile of things that could be exploited is growing far faster than the set of things attackers are actually choosing to exploit,” said Douglas McKee, Rapid7’s director of vulnerability intelligence.

Known flaws move quickly into circulation

Rapid7 found that most CVE references in underground forum posts appeared within days of a vendor advisory or an entry in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. The pattern points to rapid repackaging of disclosed flaws, rather than a surge in offers for previously unknown zero-days.

AI tools can surface vulnerabilities faster than security teams can realistically assess them, McKee said, but attackers remain selective about what they turn into working exploits. “Once a new high-severity flaw goes public, you’ve got roughly 72 hours before someone is using it in the wild, and attackers aren’t casting a wide net while they do it.”

For defenders, that compresses the time available to assess exposure and respond. A risk-based approach to vulnerability management can help teams focus on the systems most likely to be targeted, rather than treating every disclosed flaw as equally urgent.

Remote access is the clearest priority

The vulnerabilities attracting the most attention share a practical profile: attackers can reach them remotely, don’t need credentials, and don’t need a victim to click anything. Nearly 80% of the vulnerabilities exploited during the quarter fit that description, according to Rapid7.

“If your patching cadence still has the word ‘monthly’ in it, you’re defending against an adversary who abandoned that schedule a long time ago,” McKee said.

That doesn’t mean every organization should attempt to patch every flaw at once. Security leaders can start by identifying which systems are exposed to remote, unauthenticated, zero-click attacks, then deciding how many days of exposure they can accept for each system.

AI’s role in attacks remains a point of debate

Security leaders are more concerned about AI-enabled attacks than Rapid7’s findings alone might suggest. Foundry, CSO’s parent company, reported in its forthcoming Security Priorities report that 45% of CISOs rate their concern about such attacks as high. Rapid7, by comparison, identified AI as an operational component in about 8% of the attacks it tracked.

In those cases, McKee said, AI helped guide the tactical middle of an attack, such as selecting the next technique or sorting potential targets by effort. “It wasn’t deciding who to go after or why. A human still made that call.”

UnderDefense CEO Nazar Tymoshyk offered a broader warning, saying Russian advanced persistent threat groups are already using AI-powered attacks and predicting that more will follow. He said Russian and other APT groups often use Chinese models such as DeepSeek, which he described as having few constraints or guardrails, and may switch between models during an operation.

Tymoshyk also said agentic tools can give attackers access to a wider range of technical expertise, including database administration and CI/CD pipelines. Human teams often divide work among specialists in areas such as web application security and malware development; agentic systems can make that mix of skills available without assembling the same range of human specialists. For defenders, the near-term priority remains clear: find remotely exposed systems and shorten the time they remain vulnerable.