The compression era: Q2 2026 has showed that traditional patch cycles are overwhelmed.
Ungated research - no sign-up required
Disclosures doubled
High- & critical-severity CVEs year-over-year - 8,539 vs 4,268 in Q2 2025
Holy grail flaws
Of exploited vulnerabilities required no auth and no user interaction (25 of 40)
U.S. victims
Ransomware leak-site listings in the U.S. - roughly 9× Germany, the next country
Underground listings
Exploit & access listings across 20 dark web sources, 23 CVEs actively traded
Q2 2026 was not just another busy quarter in cyber. It felt more like a stress test of the way we currently manage exposure. Traditional patch cycles are being overwhelmed by the sheer volume of vulnerabilities and attacker speed and precision.
Vulnerabilities are being disclosed at higher volume, proof-of-concept code is appearing faster, exploitability is being tested earlier, and attackers are getting better at turning public information into operational access. For defenders, the issue is not simply that there is more to patch. The real issue is that the time between knowing about a weakness and seeing it used in the wild continues to collapse.
That changes the conversation. This is no longer a world where security teams can rely on traditional patch rhythms, static severity scores, or quarterly prioritization exercises. Attackers have never waited for organizations to get their defenses ready before seeking out exposed systems. But now, they have greater means than ever to get out in front of outdated security programs.
The conversation around Anthropic's AI-assisted vulnerability discovery model, Mythos, and the broader “vulnpocalypse” narrative in cybersecurity circles belongs in this report, but not as science fiction and not as marketing fear. AI does not magically turn every vulnerability candidate into a working exploit nor is finding a bug the same as understanding exploitability.
Real-world exploitation still depends on context: reachable code paths, configuration, authentication state, target architecture and, for example, environmental constraints. For CISOs and security leaders the question is not whether every AI-assisted vulnerability lead becomes a real exploit. Most will not. The question is how much reachable, exploitable exposure an organization is willing to carry when capable adversaries can use automation, tooling, and expertise to move fast through discovery, validation, and targeting.
This is why preemptive security matters. Not as a slogan, but as an operating model. Organizations cannot patch their way out of this by treating every vulnerability as equal. They need to understand what they expose, which assets matter, which weaknesses are actually reachable, which identities can be abused, and where detection must fire before initial access becomes lateral movement.
As you will see in this report, the lessons from Q2 are simple. To defend against an attacker that can compress time, defenders need to compress exposure.
To defend against an attacker that can compress time, defenders need to compress exposure.
- Rapid7 Labs, Q2 2026
Takeaway 1
Disclosures of high- and critical-severity vulnerabilities (CVSS 7–10) doubled year-over-year from 4,268 in Q2 2025 to 8,539 in Q2 2026. New exploited vulnerabilities increased 8% to 40 in Q2. Taken together this points to a widening gap between what’s disclosed and what any team can realistically triage.
Takeaway 2
The proportion of exploited vulnerabilities classified as “holy grail” (network-exploitable, no authentication, no user interaction) increased to 62% (25 of 40), a 9-point year-over-year jump compared to the 53% (24 of 45) observed in Q2 2025.
Takeaway 3
State-aligned advanced persistent threat (APT) groups tied to Iran, North Korea and Russia ran sustained campaigns against finance, government, energy, manufacturing and healthcare.
Takeaway 4
Dark web monitoring identified 124 exploit and access listings across 20 underground sources. Among the 23 CVEs being traded, most had proof-of-concept (PoC) code, and nearly 40% were exploited in the wild.
Takeaway 5
Qilin led activity with 263 victims. The United States accounted for 881 of all listed incidents, with business services and healthcare identified as the top targeted sectors.
Q2 2026 featured multiple active nation-state groups targeting a wide variety of regions and industries.
Russian campaigns
APT28 exploited SOHO edge routers for DNS hijacking, potentially allowing for the theft of authentication tokens and passwords.
Iranian campaigns
A sustained industrial control systems/operational technology (ICS/OT) campaign targeting U.S. Programmable Logic Controllers (PLCs) - specifically Rockwell Automation and Allen-Bradley systems.
Q2 2026 is all about rapid attack, and rapid response.
The volume of critical vulnerabilities, up 21% from last quarter, and the rate of publicly available proof-of-concept (PoC) code, are rising, up 12% from last quarter and 76% when compared to 2025 Q2. This indicates a growing number of easily weaponized threats.
8,539 new CVSS 7–10 CVEs in Q2 2026 vs 4,268 in Q2 2025 (+100%). Defenders need exposure context prioritization to keep pace, because attackers are already using AI to discover faster.
CWE-306 (Missing Auth) disclosures surged +247% YoY (156 vs 45); SQL Injection (CWE-89) +50% YoY (476 vs 318). Inventory your external attack surface and enforce authentication on every exposed endpoint before the exploitation curve catches up.
Attacker-friendly attributes of newly disclosed CVEs, Q2 2025 → Q2 2026
CWE-306 (Missing Auth)+247% YoY
Holy grail (remote + unauth + zero-click)+114% YoY
Public PoC available+76% YoY
CWE-89 (SQL Injection)+50% YoY
Q2 2025 → Q2 2026, quarterly - New CVSS 7–10 CVEs disclosed (bars) vs. confirmed exploited on CISA KEV (line)
Q2 2026 is all about rapid attack, and rapid response.
Popular incident techniques. Attackers consistently focus on escalating privileges and moving deeper into the network once an initial foothold is established, with a high prevalence of post-exploitation activity. Credential harvesting, abuse of Remote Management Tools, and exploitation of public-facing software remain popular.
Ransomware activity. US organizations remain the ransomware epicenter - 881 listed victims across Q2 2026, roughly 9× the #2 country, Germany, with 99. But the quarterly top 10 now includes India (35) and Thailand (15). Having two non-western countries in the leaderboard is evidence that affiliate programs are actively expanding beyond English-speaking targets. Security teams in APAC can no longer treat ransomware as mainly a US/EU problem.
IR observation
The top 3 ransomware groups of Q2 were Qilin (263 leak posts), The Gentlemen (230), and DragonForce (141).
Q2 2026 - Share of listed victims by country
Q2 2026
IR observation
Fake CAPTCHA and ClickFix social engineering techniques make up 31.8% of observed IR incidents, impacting critical sectors such as healthcare, manufacturing, and communications & media.
IR observation
Social engineering in Microsoft Teams is becoming increasingly popular, highlighting a shift from phishing emails to trusted internal collaboration channels.
Exploit trading on TOR and clearnet forums remains as popular as ever, with traditional vulnerability listings sitting alongside AI-assisted exploit discovery or AI tooling as an attack surface.
Confirmed exploited
(9 of 23) of CVEs traded underground are confirmed exploited on the CISA KEV list
Have public PoCs
(20 of 23) have public proof-of-concept code available for immediate weaponization
Holy grail
(19 of 23) are trivially exploitable - no auth and no user interaction required
Fortinet is referenced in 1 in 16 forum post listings (7 in total) - a reminder of how concentrated attacker attention on edge and remote-access appliances has become.
Inventory and patch internet-facing edge appliances - SSL-VPN, RDP gateways, and web servers.
Rotate credentials and enforce phishing-resistant MFA on every remote-access path.
Cross-reference CVEs surfacing in disclosure spikes against your asset inventory.
The second quarter of 2026 makes one thing painfully clear. The era of the wait and see patch cycle is officially over. Disclosure volume is outrunning any team's capacity to triage it, and the flaws attackers use most need no credentials and no clicks. Adversaries are simply not waiting for organizations to sit around and debate maintenance windows or who owns what. Instead they are actively hunting for the path of least resistance. That could be an unauthenticated edge appliance, a vulnerable identity path, or even a socially engineered trap inside a trusted Microsoft Teams chat.
This is not some hypothetical AI driven vulnpocalypse. It is a highly operationalized landscape where threat actors are aggressively automating their discovery processes. The practical response isn't to chase every new vulnerability - it's to shrink the exposure that is actually reachable. The board will ask how much reachable, exploitable exposure are we carrying? Answering that question with evidence is indicative of a preemptive security program. Attackers have successfully compressed the time it takes to strike, so defenders must now forcefully compress the space in which those attackers can operate.
Chase less. Expose less. Answer the board's exposure question with evidence.
- Rapid7 Labs, Q2 2026
See how a preemptive approach unifies exposure and detection - so you can compress the space attackers have to work in.