# Rapid7 Q3 2026 Threat Update: Attackers Exploiting Vulnerabilities Within 3 Days of Disclosure

> Rapid7's Q3 2026 threat update reports that attackers exploited newly disclosed vulnerabilities an average of 3 days after public disclosure, with 71% of exploitation inside 7 days. Of 43 newly exploited high/critical vulnerabilities, 79% needed no authentication or user interaction.

- **Published:** 2026-10-22T05:39:50Z
- **Last reviewed:** 2026-10-22T05:39:50Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4115
- **ID:** TL-2026-4115
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Rapid7's Q3 2026 Quarterly Threat Landscape Report (blog post published 2026-10-21) tracks 43 newly exploited high- and critical-severity vulnerabilities, down 7% from Q2 2026 and up 19% year over year. The mean time from public disclosure to exploitation was 3 days. 71% of exploitation occurred within 7 days, 80% within 14 days and 90% within 30 days. 79% of the exploited flaws (34 of 43) were remote and required no authentication or user interaction, and the report describes a subset as 'holy grail' flaws (no authentication, no user interaction, network reachable). Rapid7 concludes that monthly patch cycles no longer match attacker timelines and recommends prioritizing externally accessible assets and the vulnerabilities affecting them over CVSS score alone or fixed patching schedules.

The report also covers adjacent activity. Rapid7 counted 41 underground forum posts advertising RDP or network access (52 underground posts in total, including 14 exploit or zero-day posts, most referencing already-disclosed CVEs). Listings included enterprise footholds sold with 'tailscale + RDP'. 8% of tracked threat reporting cited AI as an operational component: operators keep target selection and objectives, and AI assists with technique selection, target triage and adaptation. Multi-session prompting was the main method noted for evading AI provider safeguards. In the ransomware data, The Gentlemen (342 incidents) and Qilin (339) led, followed by INC Ransom, DeadLock, KryBit, DragonForce, Akira, SafePay, Storm and Payouts King. The United States accounted for 60.4% of ransomware victims, followed by Germany, Italy, Canada and the United Kingdom. The most common techniques were T1059, T1027 and T1036.

Named state-aligned activity in the report includes DPRK-linked operators using a previously undocumented Linux toolkit (an HAProxy backdoor 'ted', an SSH keylogger and a curl-based RAT) against South Korean automotive and media targets, Void Blizzard (Russia-affiliated) against NATO-country government, law enforcement, defense, transport and healthcare, and Operation C-Major (Pakistan-linked) against Indian government and military. The source blog names no specific CVEs and no network IOCs; the report's per-actor CVE linkages were not independently verified, so cve_list is left empty. This is a trend and aggregate-statistics record: defenders should use it to justify compressing patch SLAs for internet-facing assets, not as a source of single-vulnerability indicators.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1650 Acquire Access
- T1059 Command and Scripting Interpreter
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1021.001 Remote Desktop Protocol
- T1056.001 Keylogging

## Sources

- [Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days](https://www.rapid7.com/blog/post/tr-q3-2026-threat-update-attackers-exploiting-vulnerabilities-within-3-days)
- [Rapid7 Quarterly Threat Landscape Report](https://www.rapid7.com/research/report/quarterly-threat-landscape-report/)
- [Rapid7 finds nearly two-thirds of vulnerabilities exploited in Q2 2026 required no user interaction (ITWire)](https://itwire.com/guest-articles/guest-research/rapid7-finds-nearly-two-thirds-of-vulnerabilities-exploited-in-q2-2026-required-no-user-interaction-to-initiate)
- [Rapid7 2026 Global Threat Landscape Report press release](https://www.rapid7.com/about/press-releases/rapid7-2026-global-threat-landscape-report-shows-exploited-high-and-critical-severity-vulnerabilities-surged-105-as-attack-timelines-collapsed)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Rapid7 Q3 Threat Report: Ransomware Alliances, AI Weaponization, and the Obsolescence of Time to Patch (2025 edition, for trend comparison)](https://investors.rapid7.com/news/news-details/2025/Rapid7-Q3-Threat-Report-Reveals-Ransomware-Alliances-AI-Weaponization-and-the-Obsolescence-of-Time-to-Patch/default.aspx)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4115