Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days
Rapid7, Wednesday, October 21st, 2026
Rapid7's Q3 threat report finds high-severity vulnerabilities are exploited three days after disclosure on average.
Rapid7 says three days is the average time between a high-severity vulnerability becoming public and its exploitation, according to its latest Quarterly Threat Landscape Report.
Seventy-one percent of exploitation tracked in Q3 happened within the first seven days.
The company says this leaves security teams with growing backlogs little time to reduce exposure.
The post summarizes the report's findings and offers guidance on prioritizing remediation.