Patching

Rapid7's Q3 2026 Quarterly Threat Landscape Report, published October 21, puts a number on how long defenders have once a high-severity flaw goes public: three days on average. Of the exploitation Rapid7 tracked in the quarter, 71% started within seven days of disclosure, 80% within 14 days and 90% within 30. Rapid7 counted 43 newly exploited vulnerabilities rated CVSS (Common Vulnerability Scoring System) 7 to 10, and 34 of them, 79%, needed no login and no action from a user.

If your patch policy gives critical vulnerabilities 14 or 30 days, most of the attacks Rapid7 saw had already started by the deadline. This matters most for anything reachable from the internet: VPN gateways, firewalls, mail gateways, file transfer servers and remote access tools.

What the numbers measure

Rapid7 counts the days between a vulnerability's public disclosure and the first exploitation it can confirm. The distribution is front-loaded: a large share of attacks come in the first few days, some bugs are hit on the day of disclosure, and the tail after day 30 is small. For a defender, the 71% figure matters more than the average, because it says most of the risk arrives before a weekly change window has even come round twice.

The 34 of 43 that need no authentication and no user interaction are what Rapid7 calls "holy grail" flaws. An attacker who can reach the service over the network can exploit them directly, with no stolen password and no phishing email. They are why exposure to the internet should weigh more in patch decisions than the CVSS number alone.

The report's year-on-year view explains why patching everything faster does not work either. Compared with Q3 2025, new CVEs rated 7 to 10 rose 133% and those with a public proof of concept rose 86%, but confirmed exploitation rose only 19%. The 43 exploited flaws in Q3 were 7% fewer than in Q2. Disclosures are growing far faster than attacks, so a policy that treats every CVSS 9 the same will drown in work while the handful of flaws actually being used slip through.

Rapid7 also broke exploitation down by impact type. Authentication bypass flaws, where the attacker skips the login step entirely, had the highest exploitation rate at 1.57% (3 of 191). Remote code execution was much more common, with 2,082 new CVEs, but under 1% of those were exploited.

What attackers did with the window

A worked example from the quarter shows how fast this runs. F5 disclosed CVE-2026-94127, a CVSS 9.8 flaw in BIG-IP Access Policy Manager that we covered in our F5 post, on September 22, and CISA (the US Cybersecurity and Infrastructure Security Agency) added it to its Known Exploited Vulnerabilities (KEV) catalog the same day. Rapid7 found an underground forum thread discussing it on September 25, three days later. Of the 63 underground posts Rapid7 monitored, 14 sold, shared or discussed exploits or claimed zero-days, and 41 advertised RDP (Remote Desktop Protocol) or other network access.

The same report shows that old flaws stay in use when nobody patches them. Rapid7 linked 15 CVEs to six state and criminal groups during the quarter. They include CVE-2018-0171, a CVSS 9.8 bug in Cisco IOS Smart Install from 2018, which Rapid7 ties to Energetic Bear; the FBI warned in August 2025 that Russia's FSB Center 16 was exploiting it against network devices. Rapid7 also ties APT31 to eight of those CVEs.

Ransomware fed on the same access. The Gentlemen posted 342 victims to its leak site in Q3 and Qilin 339, followed by INC Ransom (99), DeadLock (98) and KryBit (95). US organisations accounted for 1,112 listings, about eight times Germany's total, and business services, manufacturing and healthcare were the most targeted sectors. Government victims in the ten most affected countries rose from 48 in Q2 to 55.

Only 8% of the threat reporting Rapid7 tracked cited AI as an operational part of an attack, and in every documented case a human still picked the target. The three-day window comes from people working quickly on public bugs.

What to do

Rapid7 recommends starting from what is exposed, ranking by known exploitation and unauthenticated access, and using compensating controls where a patch cannot go in at once. Turned into a patch policy, that looks like this:

1. Keep an inventory of what faces the internet. You cannot meet a three-day deadline on a device you did not know was exposed. List every VPN, firewall management interface, mail gateway, file transfer server, remote access tool and public web application, with its exact version, and compare it with an external scan at least monthly.
2. Add an emergency tier above "critical". The trigger is a flaw on an internet-facing system that is either confirmed exploited (in CISA KEV or the vendor's advisory) or exploitable without authentication. Mitigate within 24 hours and patch within 72. Mitigation means the vendor's workaround, disabling the affected feature, or taking the interface off the internet. For CVE-2018-0171 that is no vstack on the switch and blocking TCP port 4786 at the edge.
3. Tighten the next tier. Other high and critical flaws on internet-facing systems get 7 days. Internal systems with an exploited flaw get 14, matching CISA's default two-week KEV deadline for federal agencies. The rest can keep 30 days, which still meets PCI DSS (Payment Card Industry Data Security Standard) requirement 6.3.3 for critical patches.
4. Automate the trigger. Pull CISA's KEV feed (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) daily and match it against your inventory, so a new entry opens a ticket with the emergency deadline without anyone reading the news first.
5. Hunt back to the disclosure date. If you patched an emergency-tier flaw on day five, assume the first four days were exposed. Review that device's logs from the disclosure date onward for new admin accounts, configuration changes and unexpected outbound connections, and check it against the vendor's published indicators of compromise. If you find signs of access, rotate every credential and session secret the device held.
6. Watch the access that gets sold. With RDP the most advertised access type, check that TCP 3389 is not open to the internet, and review Windows Security event ID 4624 with logon type 10 (remote interactive) for sources outside your VPN range.

Deadlines by exposure, not by score

The report's figures argue against a single deadline per CVSS band. A CVSS 9.8 on an internal test server carries less risk than a CVSS 7.5 authentication bypass on your VPN that is already in KEV. Two facts decide the tier: can an attacker reach it from the internet, and is anyone exploiting it yet. As Rapid7's Christiaan Beek put it, defenders should ground their risk appetite "in concrete days of exposure".

It also changes what to report upward. Mean time to patch across all CVEs hides how many days your internet-facing, exploited flaws stayed open. Track that figure separately, with a target of three days or fewer.

Our attack surface management service finds the internet-facing systems that belong in the emergency tier, and our security operations team runs the lookback hunts when a patch lands late. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Rapid7, Q3 2026 Quarterly Threat Landscape Report, Rapid7 blog, Q3 2026 threat update, Rapid7 press release, Help Net Security, SecurityWeek, IT Brief UK, Intelligent CISO, FBI PSA on CVE-2018-0171, CISA KEV catalog.