When Attackers Exploit High-Severity Flaws in Three Days, the Monthly Patch Cycle Is a Risk Decision, Not a Schedule

LONDON - Most security teams still describe vulnerability response in calendar terms. Patch Tuesday, the monthly change window, a 30-day service level for anything rated critical. Rapid7's latest quarterly threat report, released with a company blog post on Wednesday, makes a strong case that the calendar is the wrong instrument.

Rapid7 Intelligence tracked 43 newly exploited high- and critical-severity vulnerabilities in the third quarter of 2026, all rated 7 to 10 on CVSS. On average, exploitation began three days after public disclosure. Seventy-one percent of the exploitation it tracked happened within the first seven days, 80 percent within 14 days and 90 percent within 30. The report's own introduction does not soften the point: "If your patch cycle still has the word 'monthly' in it, congratulations: It's perfectly calibrated for an adversary who stopped existing a while ago."

The clock starts before the list does

One figure on the same page deserves more attention than it will get. Rapid7 puts the median time between public disclosure and a vulnerability appearing on CISA's Known Exploited Vulnerabilities catalog at three days as well. KEV is an indispensable signal, but a team that waits for the listing to start its own clock is starting it at roughly the point when, on average, attackers already have.

The flaws attackers chose were also the easiest to reach. Of the 43, Rapid7 counted 34, or 79 percent, that required no authentication and no user interaction, the remote, unauthenticated class the report calls "holy grail" vulnerabilities. No phishing lure is needed and no stolen credential. An exposed service and a public advisory are enough.

Volume is not the problem. Selection is.

The tempting response is to patch everything faster. The data argues for something more disciplined. Rapid7 counted 43 newly exploited vulnerabilities, down 7 percent from the second quarter, even as new CVEs rated 7 to 10 rose 133 percent from a year earlier. It found that about one in ten public proofs of concept, 9.4 percent, became an active attack within 30 days. Most high-severity disclosures are not exploited. The ones that are tend to share a profile: reachable from the internet, no login required, and attacked within days.

That makes this a security operations problem as much as a patching one. The gap between disclosure and a completed fix is a detection and response window, and the SOC is the team that can see whether it is being used. Rapid7's own guidance points the same way: identify externally accessible assets and the vulnerabilities affecting them, prioritize known exploitation, unauthenticated access paths and systems that support critical business functions, and where immediate remediation is not possible, assess compensating controls and detection coverage.

In practice, that means the SOC should hold three things in the first 72 hours after a high-severity disclosure. A current list of which internet-facing systems run the affected product. A hunt for exploitation on those systems that starts on disclosure day, not on KEV day. And a compensating control, from isolation to a web application firewall rule to tightened access, for every exposed system that cannot be patched inside the window.

The underground is selling last week's advisories

The report's dark web section reinforces the point. Of 63 underground posts Rapid7 tracked in the quarter, 41 advertised RDP or network access. Fourteen involved the sale, sharing or discussion of exploits, and most of those referenced CVEs that were already in vendor advisories or CISA KEV within days of disclosure. Rapid7's example is a Sept. 25 forum thread on CVE-2026-94127, the F5 BIG-IP APM flaw disclosed on Sept. 22. Attackers are not waiting for exotic zero-days. They are repackaging public advisories faster than many organizations schedule a change.

The threat is the clock, not the robot

None of this depends on artificial intelligence. Eight percent of the threat reporting Rapid7 tracked cited AI as an operational component, and in every documented case a human still chose the target. "The finding I'd put in front of anyone is that AI showed up as an operational component in only 8% of the incidents we tracked," Douglas McKee, Rapid7's director of vulnerability intelligence, told SecurityWeek. "That's interesting because the board-deck version of this year has been wall-to-wall AI attackers, and the data doesn't support that story."

That should be a relief, and a warning. The three-day window was produced by ordinary attackers moving quickly against reachable, unauthenticated services. Defenders do not need to wait for an AI arms race to justify changing how they measure exposure. They need to stop measuring patch compliance against a monthly calendar and start measuring how many days each exploited, internet-facing flaw stayed open, and what the SOC did during those days.

Rapid7 frames the choice as one of risk appetite rather than patching, and its closing line is the right standard for any security leader signing off on a 30-day service level: "A risk appetite you can't express in days of exposure is just hope with a budget."