Rapid7: 19% Surge in Exploits as Hackers Target Remote Flaws in 72 Hours

Attackers are gaining rapid access to systems by targeting a narrow set of critical vulnerabilities, packaging them into functional exploits within as little as three days of public disclosure. This speed allows adversaries to bypass traditional defense timelines, focusing on flaws that offer immediate remote access without requiring user interaction or authentication. The strategy prioritizes efficiency over novelty, leveraging known weaknesses rather than seeking new zero-day discoveries.

In plain English

The threat landscape has shifted from slow, methodical campaigns to rapid-fire exploitation of high-severity flaws. Adversaries no longer wait weeks to develop tools; instead, they repurpose publicly available proof-of-concept code almost immediately after a vulnerability is announced. This means that once a flaw is known, defenders have a very short window to protect their infrastructure before active attacks begin in the wild.

The background

Rapid7’s Quarterly Threat Landscape report for the third quarter of 2026 recorded 43 newly exploited vulnerabilities, a 19% increase from the previous year. Douglas McKee, director of vulnerability intelligence at Rapid7, cautioned against viewing this as a steady climb. He noted that new high-severity CVEs, rated between 7 and 10, surged 133% year over year, while publicly available proof-of-concept code rose 86%. The volume of potential targets is growing much faster than the actual exploitation rate.

What changes now

Underground forum activity reveals that most posts reference CVEs already listed in vendor advisories or the CISA Known Exploited Vulnerabilities catalog within days of disclosure. This indicates commercial repackaging of known flaws rather than novel zero-day sales. Nearly 80% of exploited vulnerabilities this quarter allowed remote access without login credentials or user clicks. McKee stated that AI tooling surfaces flaws faster than teams can triage them, but attackers remain selective, choosing only the most impactful weaknesses to weaponize.

What made it possible

Security teams usually face a race against time when high-severity flaws are disclosed. The primary risk stems from the gap between public disclosure and patch deployment. Adversaries exploit this window by using automated tools to scan for unpatched systems. Defenders should check whether their monitoring detects rapid configuration changes or unusual outbound connections shortly after a major vulnerability announcement. Focusing on remote, unauthenticated services reduces exposure because these are the easiest targets for automated exploitation scripts.

What to do and how to stay safe: Rapid7

• Monitor threat intelligence feeds for new high-severity CVEs and prioritize patching remote, unauthenticated services immediately.
• Implement network segmentation to limit lateral movement if an initial compromise occurs through a known vulnerability.
• Review firewall rules to block unnecessary inbound traffic to critical infrastructure components that do not require public access.
• Verify that vulnerability scanning tools are configured to detect newly disclosed flaws within hours of publication.

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How quickly are attackers exploiting new vulnerabilities?

Attackers exploited select high-severity flaws within an average of three days, with 71% of tracked exploitation landing within a week, according to Rapid7.

What type of vulnerabilities are attackers targeting?

Attackers favor vulnerabilities that require no authentication and little or no user interaction, with nearly 80% of exploited flaws allowing remote access.

Is the rise in exploitation due to new zero-day attacks?

No, Rapid7 indicates the trend reflects rapid commercial repackaging of known flaws already in vendor advisories or the CISA KEV catalog, rather than novel zero-day sales.