The time between a high-severity disclosure and someone using it in anger is now measured in days, not weeks. Rapid7’s latest Quarterly Threat Landscape puts the average at three days, with 71 percent of tracked exploitation landing within the first week.
The firm counted 43 newly exploited vulnerabilities in Q3 2026, a 19 percent rise year on year. Douglas McKee, director of vulnerability intelligence, cautioned against reading that as a gentle climb. New high-severity CVEs rated 7 through 10 rose 133 percent over the same stretch, and public proof-of-concept code rose roughly 86 percent.
A narrower target list
Attackers are being choosy. Nearly 80 percent of what got exploited this quarter could be reached remotely, required no login, and needed nothing from the victim beyond being there.
That gap between the growing pile of exploitable flaws and the smaller set attackers actually use is the story. Most underground forum activity referenced CVEs already published in vendor advisories or added to CISA’s Known Exploited Vulnerabilities catalog within days, which points to commercial repackaging of known bugs rather than a wave of genuine zero-days.
What to do with the 72 hours
McKee’s advice is not to patch everything faster. It is to know which systems match the profile attackers prefer, then decide deliberately how many days of exposure each can carry. That is a risk conversation, not a maintenance schedule.
For leaders, the practical consequence is uncomfortable: a monthly cadence now defends against an adversary who abandoned that rhythm long ago. Inventory the internet-facing, unauthenticated services first. For each one, write down the acceptable window between a patch landing and it being applied, and be honest about which windows are currently open-ended.
