Rapid7 Cybersecurity Q3 Threat Landscape Report
Q3 2026 has shown that attackers exploit new high-severity vulnerabilities in an average of just three days.
Q3 2026 has shown that attackers exploit new high-severity vulnerabilities in an average of just three days.
Of exploited vulnerabilities rated 7-10 CVSS required no authentication and no user interaction (34 of 43) Advertising RDP or network access; access-for-sale listings dominated the quarter If you only keep one number from this report, make it 3.
That's the average time between a new high-severity vulnerability going public and someone using it against somebody else.
We announced the Rapid7 Intelligence Organization, built on a simple idea: The research, the incident response front line, and the underground monitoring shouldn't sit in separate rooms, nodding politely at each other in meetings.
You'll see that in this report: The vulnerability data, the leak sites, the forums, and what our responders keep running into come together as one story instead of four.
On the ransomware side, The Gentlemen and Qilin finished in a near photo finish, 342 versus 339 leak-site posts, before the field falls off a cliff to 99 for INC Ransom.
The U.S. alone accounts for 1,112 listings, roughly eight times Germany, and in the government sector its share among the top ten countries jumped from 33% to 45%.
And 71% of all the exploitation we tracked landed inside the first seven.
Meanwhile on the underground forums, 41 of 63 posts were someone selling a way in, and the exploits on offer were mostly last week's advisories in a fresh jacket.
Government-sector incidents are concentrated more heavily at the U.S. among the countries we tracked in the ransomware top 10, with the U.S. share making up 45% of 55 Q3 government-centric incidents.
So if your patch cycle still has the word monthly in it, congratulations: It's perfectly calibrated for an adversary who stopped existing a while ago.
What happened
Q3 2026 has shown that attackers exploit new high-severity vulnerabilities in an average of just three days.
Of exploited vulnerabilities rated 7-10 CVSS required no authentication and no user interaction (34 of 43) Advertising RDP or network access; access-for-sale listings dominated the quarter If you only keep one number from this report, make it 3.
That's the average time between a new high-severity vulnerability going public and someone using it against somebody else.
What changed
We announced the Rapid7 Intelligence Organization, built on a simple idea: The research, the incident response front line, and the underground monitoring shouldn't sit in separate rooms, nodding politely at each other in meetings.
You'll see that in this report: The vulnerability data, the leak sites, the forums, and what our responders keep running into come together as one story instead of four.
Who is affected
On the ransomware side, The Gentlemen and Qilin finished in a near photo finish, 342 versus 339 leak-site posts, before the field falls off a cliff to 99 for INC Ransom.
The U.S. alone accounts for 1,112 listings, roughly eight times Germany, and in the government sector its share among the top ten countries jumped from 33% to 45%.
Technical details
And 71% of all the exploitation we tracked landed inside the first seven.
Meanwhile on the underground forums, 41 of 63 posts were someone selling a way in, and the exploits on offer were mostly last week's advisories in a fresh jacket.
Government-sector incidents are concentrated more heavily at the U.S. among the countries we tracked in the ransomware top 10, with the U.S. share making up 45% of 55 Q3 government-centric incidents.
Response
So if your patch cycle still has the word monthly in it, congratulations: It's perfectly calibrated for an adversary who stopped existing a while ago.
Attribution
Rapid7: Q3 2026 has shown that attackers exploit new high-severity vulnerabilities in an average of just three days.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.