Rapid7 Reports Surge in Vulnerability Exploitation Outpacing Patching Efforts

• •High and critical CVEs doubled to 8,539 in Q2 2026, with a 40% rise in newly exploited vulnerabilities.
• •62% of newly exploited vulnerabilities required no user interaction, marking a significant shift in attack methods.
• •Ransomware attacks are concentrated in the U.S., with 881 reported victims, highlighting the geographical expansion of threats.

Rapid7's Q2 2026 Threat Landscape Report reveals a significant increase in vulnerability disclosures, with high and critical vulnerabilities doubling to 8,539. Newly exploited vulnerabilities surged by 40%, with 62% requiring no user interaction to exploit. The report highlights that attackers are leveraging automation and AI to exploit vulnerabilities faster than organizations can patch them. Missing authentication flaws saw a 247% increase year-over-year, expanding the attack surface. Ransomware attacks are also on the rise, particularly in the U.S., which recorded the highest number of victims. The report emphasizes the need for security teams to focus on evidence-based exposure management rather than relying solely on static severity scores. State-aligned cyber campaigns from Iran, North Korea, and Russia continue to target critical infrastructure. The overall cybersecurity landscape is increasingly challenging, necessitating a shift in security strategies.