Exploitation Windows Stay Narrow
Rapid7's Q3 2026 Quarterly Threat Landscape Report, published October 21, finds that high-severity vulnerabilities are exploited on average three days after becoming public. The report also concludes that human operators, not autonomous AI, still drive most tracked attacks.
Key Figures
| Metric | Finding |
|---|---|
| Average time to exploitation | 3 days after public disclosure |
| Exploited within 7 days | 71% |
| Exploited within 14 days | 80% |
| Exploited within 30 days | 90% |
| Newly exploited high/critical flaws | 43 (down 7% from Q2, up 19% year over year) |
| Needing no authentication or user interaction | 79% |
| AI operational role in tracked reports | 8% |
| US ransomware leak-site listings | 1,112, about eight times Germany's total |
| Underground posts selling RDP or network access | 41 |
What Stands Out
Speed. With 71% of exploitation occurring in the first week, the practical patch window for internet-facing systems is measured in days. The 43 newly exploited flaws were slightly fewer than in Q2, but the trend over the year is still upward.
Ease of attack. Roughly four in five exploited flaws needed neither credentials nor a victim's action, which favors opportunistic mass exploitation of edge devices and web-facing software.
Ransomware. The United States accounted for the highest volume of ransomware leak-site listings among tracked countries, at 1,112 for the quarter.
AI. Rapid7 found AI played an operational role, such as technique selection or adapting attacks, in just 8% of tracked threat reports. Attacker adoption of agentic AI is lagging the technology's capabilities.
Recommendations
For IT Admins
- Prioritize internet-facing systems and treat critical patches as same-week work, not monthly work
- Maintain an accurate inventory of edge devices so exposure can be assessed within hours of a new advisory
For Security Teams
- Use exploitation signals such as CISA KEV, vendor advisories, and honeypot reports to rank patching, not CVSS alone
- Watch for sold RDP and VPN access tied to your organization, since initial-access brokers feed ransomware operations
- Keep tested offline backups and an incident response plan for ransomware
Key Takeaways
- Three days is the benchmark — disclosure-to-exploitation timing leaves little room for slow patch cycles
- Unauthenticated flaws dominate — 79% of exploited vulnerabilities needed no credentials or user interaction
- Ransomware remains the main outcome — leak-site volume in the US was far above any other tracked country
- AI hype exceeds observed use — at 8% of reports, AI is still a minor factor in real incidents