71% of vulnerability exploitation starts within a week of disclosure

Rapid7's Q3 2026 Quarterly Threat Landscape Report finds that attackers now move from public disclosure to active exploitation of high-severity flaws in just three days on average, with 71% of observed exploitation happening in the first week. The firm tracked 43 newly exploited high- and critical-severity vulnerabilities in the quarter, 34 of which required no authentication or user interaction, making fixed patch schedules insufficient against fast-moving threats. The report also ties 15 vulnerabilities to six nation-state-linked actor groups—including North Korea-linked activity against South Korean automotive and media firms, Russia-linked Void Blizzard targeting NATO and Ukraine, and Pakistan-linked Operation C-Major against Indian government and military targets—while noting AI played an operational role in only 8% of tracked incidents. Separately, U.S. government-sector ransomware reports rose 15% quarter-over-quarter, and underground markets remained dominated by RDP and network-access sales rather than genuine zero-day trading.