Attackers are weaponizing select high-severity security vulnerabilities within an average of three days of disclosure, with nearly 80% of exploited flaws this quarter requiring no authentication or user interaction, according to Rapid7's latest Quarterly Threat Landscape report. The analysis found that while newly exploited vulnerabilities rose 19% year over year in Q3 2026, the gap between what could be attacked and what actually is attacked continues to widen dramatically. Attackers are being selective, favoring a narrow profile of remote, unauthenticated, zero-click exploits rather than casting a wide net.
The number of newly exploited vulnerabilities reached 43 in the third quarter of 2026, up 19% compared to the same period last year, the report shows. But new high-severity CVEs rated between 7 and 10 jumped 133% year over year, while publicly available proof-of-concept code surged roughly 86% during the same timeframe. Rapid7 tracked exploitation activity and found that 71% occurred within a week of disclosure. Most underground forum posts referenced CVEs already listed in vendor advisories or in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog within days of disclosure, pointing to swift commercial repackaging of known flaws rather than a surge in genuine zero-day sales.
"Once a new high-severity flaw goes public, you've got roughly 72 hours before someone is using it in the wild, and attackers aren't casting a wide net while they do it," said Douglas McKee, director of vulnerability intelligence at Rapid7. The study determined that vulnerabilities requiring no authentication and minimal or zero user interaction are preferred for remote exploitation. McKee warned that organizations whose patching rhythm still includes the word "monthly" are defending against an adversary who abandoned that timeline long ago. According to McKee, AI tooling is surfacing flaws faster than any team can realistically triage them, but adversaries remain selective about which ones they weaponize.
The report explains that rather than trying to patch everything more quickly, security teams should prioritize based on risk management questions and issues specific to their environments. Given attackers' current preferences, security leaders should identify systems exposed to that remote, unauthenticated, zero-click attack profile and determine how many days of exposure they're willing to accept on each. Defenders need to adjust to a reality where high-severity flaws are turned into exploits in days rather than weeks. The pile of things that could be exploited is expanding far faster than the set of things attackers are actually choosing to exploit, which means the challenge isn't volume but precision in identifying what matters most.
Artificial intelligence appeared as an operational component in only about 8% of the attacks Rapid7 tracked, running the tactical middle of attacks by choosing the next technique or triaging which targets were worth the effort, though a human still made the strategic call about who to target and why. Security leaders' concerns about AI-enabled attacks are rising, with 45% of CISOs rating their concern high in Foundry's forthcoming Security Priorities report. Other security experts warn of a growing wave of AI-orchestrated attacks, with Russian APT groups already running AI-powered attacks using Chinese models such as DeepSeek that have few constraints or guardrails. By deploying agentic attacks, hackers can tap into a deeper pool of technical knowledge spanning database administration, CI/CD pipelines, and other specialties than conventional human-only attack teams typically achieve, since human teams tend to consist of individuals specializing in specific technical skills. Organizations that continue to rely on monthly patch cycles while adversaries operate on 72-hour timelines risk leaving their most critical assets exposed during the window attackers exploit most aggressively. The shift toward prioritizing systems matching the remote, unauthenticated, zero-click profile represents a fundamental change in how defenders must allocate limited security resources in an environment where speed trumps comprehensiveness.