8,539 reasons to rethink how vulnerabilities get patched

8,539 reasons to rethink how vulnerabilities get patched The window for responding to newly disclosed security flaws is getting shorter. Exploit code can appear quickly, exploitability can be tested soon after disclosure, and organizations have a growing number of weaknesses to sort through. Rapid7’s Q2 2026 Threat Landscape Report counted 8,539 high- and critical-severity vulnerability disclosures, twice the number recorded a year earlier. Source: Rapid7 The increase adds pressure to a patching process that requires teams to decide which problems deserve immediate attention. A vulnerability’s severity score can help with that decision, but exposure and reachability also matter. A flaw on an internet-facing system can present a different security problem from one that attackers cannot readily reach. “Security teams are chasing ghosts if they think they’re ‘secure’ just by closing tickets based on CVSS scores. We’re drowning in a deluge of disclosures, and the gap between a patch existing and an exploit being weaponized has collapsed to near zero,” said Christiaan Beek, Vice President, Rapid7 Labs. “If you’re still relying on periodic patch cycles while your adversary is automating their kill chain, you aren’t managing risk, you’re just subsidizing the attackers’ R&D. Stop collecting CVEs and start focusing on the exposures that actually matter.” Attackers have increasing access to publicly available information and tools that can help them test newly disclosed weaknesses. The number of newly disclosed vulnerabilities with publicly available proof-of-concept code increased 76% compared with Q2 2025, adding to the pool of vulnerabilities that may be easier to test or weaponize. Some flaws require little from the victim Of the newly exploited vulnerabilities tracked during the quarter, 62% were network-exploitable and required neither authentication nor user interaction. These weaknesses can give an attacker a route into a vulnerable system without first obtaining login credentials or convincing someone to open a file or click a link. The share increased from the same period a year earlier. Internet-facing devices deserve particular attention in this environment. VPN systems, remote access gateways, web servers, routers, and other exposed infrastructure can provide an entry point when vulnerable software is reachable from the internet. Organizations can reduce that exposure by maintaining an accurate inventory of externally accessible systems, identifying vulnerabilities that are reachable and enforcing authentication on exposed endpoints. Attackers are going after people Fake CAPTCHA and ClickFix techniques accounted for 31.8% of observed incident response cases during the quarter. These attacks commonly present users with instructions that appear to solve a browser problem or complete a verification step. Following those instructions can lead to malicious commands being run on the device. Social engineering activity has also moved into Microsoft Teams. That gives attackers another place to approach employees using communication that can appear to come through a familiar workplace service. Once access is established, attackers continue to focus on escalating privileges and moving deeper into networks. Credential harvesting, abuse of remote management tools and exploitation of public-facing software remain common techniques. Ransomware remains part of the workload The United States recorded 881 listed ransomware victims during the quarter, the largest number of any country and roughly nine times the 99 recorded in Germany. India recorded 35 listed victims and Thailand 15. Business services and healthcare were identified as the top targeted sectors. State-aligned groups tied to Iran, North Korea, and Russia carried out sustained campaigns involving finance, government, energy, manufacturing, technology, healthcare, telecom, digital infrastructure, education, and defense. Russian-linked APT28 activity included exploitation of small office and home office routers for DNS hijacking, which can expose authentication tokens and passwords. Iranian activity included targeting of industrial control and operational technology systems in the United States. Exploits are circulating underground Underground markets provide another channel for vulnerability information and access. Monitoring during the quarter identified exploit and access listings across 20 underground sources. Most of the vulnerabilities observed being traded already had publicly available proof-of-concept code, while some were listed in the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. A large majority were also classified as network-exploitable vulnerabilities requiring no authentication or user interaction. Internet-facing edge appliances remain a particular area of concern. Recommended measures include inventorying and patching SSL-VPN systems, RDP gateways and web servers, rotating credentials, and enforcing MFA on remote-access paths. Teams can cross-reference vulnerabilities appearing during disclosure spikes with their asset inventories. There is a widening gap between the number of vulnerabilities being disclosed and the number security teams can triage. Prioritization depends on knowing which systems are exposed to the internet, which vulnerabilities are reachable and which access paths could provide a route into the network. That context can help organizations determine where patching and other security measures require attention first, instead of treating every newly disclosed vulnerability as an equal priority.