Threat reportVulnerabilityTL-2026-4115
Rapid7 Q3 2026 Threat Update: Attackers Exploiting Vulnerabilities Within 3 Days of Disclosure
Rapid7 Q3 2026 Threat Update (TL-2026-4115), also tracked as Rapid7 Q3 2026 Quarterly Threat Landscape Report, is a high-severity software vulnerability, first published 2026-10-22. It has no confirmed attribution, affects Multiple Internet-facing applications, edge devices and remote access, maps to 11 MITRE ATT&CK techniques (T1021.001, T1027, T1036), and is covered by 9 detection rules and 17 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 11MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-4115
- Threat ID
- TL-2026-4115
- Also known as
- Rapid7 Q3 2026 Quarterly Threat Landscape Report
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- business services, manufacturing, health, technology, construction, government administration, aerospace, defense, transport, finance, energy, automotive
- Target regions
- North America, Europe, south korea, india
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in Rapid7 Q3 2026 Threat Update
Malware and tooling: AgendaCrypt, Akira, DeadLock, DragonForce, Storm, curlRAT, inc ransom, krybit, payoutsking, safepay, ted, the gentlemen
How Rapid7 Q3 2026 Threat Update works
Rapid7's Q3 2026 threat update reports that attackers exploited newly disclosed vulnerabilities an average of 3 days after public disclosure, with 71% of exploitation inside 7 days. Of 43 newly exploited high/critical vulnerabilities, 79% needed no authentication or user interaction.
Rapid7's Q3 2026 Quarterly Threat Landscape Report (blog post published 2026-10-21) tracks 43 newly exploited high- and critical-severity vulnerabilities, down 7% from Q2 2026 and up 19% year over year. The mean time from public disclosure to exploitation was 3 days. 71% of exploitation occurred within 7 days, 80% within 14 days and 90% within 30 days. 79% of the exploited flaws (34 of 43) were remote and required no authentication or user interaction, and the report describes a subset as 'holy grail' flaws (no authentication, no user interaction, network reachable). Rapid7 concludes that monthly patch cycles no longer match attacker timelines and recommends prioritizing externally accessible assets and the vulnerabilities affecting them over CVSS score alone or fixed patching schedules.
The report also covers adjacent activity. Rapid7 counted 41 underground forum posts advertising RDP or network access (52 underground posts in total, including 14 exploit or zero-day posts, most referencing already-disclosed CVEs). Listings included enterprise footholds sold with 'tailscale + RDP'. 8% of tracked threat reporting cited AI as an operational component: operators keep target selection and objectives, and AI assists with technique selection, target triage and adaptation. Multi-session prompting was the main method noted for evading AI provider safeguards. In the ransomware data, The Gentlemen (342 incidents) and Qilin (339) led, followed by INC Ransom, DeadLock, KryBit, DragonForce, Akira, SafePay, Storm and Payouts King. The United States accounted for 60.4% of ransomware victims, followed by Germany, Italy, Canada and the United Kingdom. The most common techniques were T1059, T1027 and T1036.
Named state-aligned activity in the report includes DPRK-linked operators using a previously undocumented Linux toolkit (an HAProxy backdoor 'ted', an SSH keylogger and a curl-based RAT) against South Korean automotive and media targets, Void Blizzard (Russia-affiliated) against NATO-country government, law enforcement, defense, transport and healthcare, and Operation C-Major (Pakistan-linked) against Indian government and military. The source blog names no specific CVEs and no network IOCs; the report's per-actor CVE linkages were not independently verified, so cve_list is left empty. This is a trend and aggregate-statistics record: defenders should use it to justify compressing patch SLAs for internet-facing assets, not as a source of single-vulnerability indicators.
MITRE ATT&CK techniques used in TL-2026-4115
Lateral Movement
T1021.001 Remote Desktop Protocol
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
Collection
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Resource Development
T1588.006 Vulnerabilities; T1650 Acquire Access
Reconnaissance
Affected products and versions in Rapid7 Q3 2026 Threat Update
- Multiple — Internet-facing applications, edge devices and remote access services
Vulnerable versions: Unpatched products with newly disclosed high/critical vulnerabilities
Fixed in: Vendor-patched releases
Remediation for Rapid7 Q3 2026 Threat Update
Patches
- Apply vendor patches for internet-facing products as soon as released; treat the first 7 days after disclosure as the critical window
Immediate actions
- Inventory internet-facing assets and prioritize unauthenticated, no-interaction vulnerabilities on them for patching within days, not monthly cycles
- Review RDP, VPN and remote-access exposure and remove or restrict anything not required
- Check CISA KEV and vendor advisories daily for edge devices and public-facing applications
Workarounds
- Where a patch is not available, apply vendor mitigations, WAF or virtual patching and restrict access to management interfaces
Longer-term hardening
- Replace CVSS-only prioritization with exploitability, exposure and active-exploitation signals
- Enforce MFA on all remote access and valid-account paths to blunt purchased network access
- Monitor underground access-broker listings for your organization and exposed credentials
- Deploy EDR and behavioral detection for command and scripting interpreter abuse, obfuscation and masquerading
Weaknesses (CWE) in Rapid7 Q3 2026 Threat Update
Timeline of Rapid7 Q3 2026 Threat Update
- Rapid7 publishes its 2026 Global Threat Landscape Report: exploited high/critical vulnerabilities up 105% year over year (71 in 2024 to 146 in 2025); median time from publication to CISA KEV inclusion fell from 8.5 to 5.0 days.
- Start of the Q3 2026 tracking period in which Rapid7 observed 43 newly exploited high/critical vulnerabilities.
- Rapid7 publishes its Q2 2026 report: 62% of newly exploited vulnerabilities needed no user interaction or authentication; proof-of-concept code up 76% year over year.
- End of the Q3 2026 tracking period; mean disclosure-to-exploitation time was 3 days, 71% within 7 days, 80% within 14 days, 90% within 30 days.
- Rapid7 Quarterly Threat Landscape Report page updated with Q3 data: The Gentlemen (342) and Qilin (339) lead ransomware incident counts; 8% of tracked reporting cites AI as an operational component.
- Rapid7 publishes the Q3 2026 Threat Update blog: 43 newly exploited vulnerabilities (down 7% QoQ, up 19% YoY), 79% requiring no authentication or user interaction, 41 underground posts selling RDP or network access.
Sources cited for Rapid7 Q3 2026 Threat Update
- Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days
- Rapid7 Quarterly Threat Landscape Report
- Rapid7 finds nearly two-thirds of vulnerabilities exploited in Q2 2026 required no user interaction (ITWire)
- Rapid7 2026 Global Threat Landscape Report press release
- CISA Known Exploited Vulnerabilities Catalog
- Rapid7 Q3 Threat Report: Ransomware Alliances, AI Weaponization, and the Obsolescence of Time to Patch (2025 edition, for trend comparison)
Detection coverage for TL-2026-4115
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4115 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.