Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days
Three days is the average time between a high-severity vulnerability becoming public and its exploitation, according to the latest Quarterly Threat Landscape Report from Rapid7. And 71% of the exploitation tracked in Q3 occurred within the first seven days. For security teams already managing growing vulnerability backlogs, this creates a difficult question: How do you reduce exposure when attackers can exploit vulnerabilities before your next patching window? Rapid7's Q3 2026 research brings together vulnerability intelligence, ransomware activity, APT tracking, and underground forum intelligence to show where attacker activity is concentrated. The exploitation window has narrowed, big time
- Vendor
- Rapid7
- Product
- InsightVM / Nexpose / Metasploit
- Exploitation
- observed in the wild
- Exposure class
- Network management
Why it ranks 34 (Notable)
- Exploitation observed in the wild
- Product class: network management
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Rapid7 research (rapid7.com)