Rapid7: 71% of exploits appear within a week of disclosure

Rapid7's Q3 2026 threat report found an average of three days between disclosure and exploitation of high-severity vulnerabilities, with 71% of tracked exploitation occurring in the first week. Of 43 newly exploited flaws, 34 required neither authentication nor user interaction.

• Average time from disclosure to exploitation was three days
• 71% of tracked exploitation happened within the first week
• 34 of 43 flaws were exploited without authentication or user interaction
• AI was an operational component in 8% of tracked threat reporting