Rapid7 Labs Quarterly Threat Landscape Report, Q2 2026

Rapid7's Q2 2026 quarterly report: high- and critical-severity disclosures doubled year on year to 8,539 while the number newly exploited held flat at 40 — and 62% of what was exploited needed no user interaction at all

Rapid7 Labs published its Quarterly Threat Landscape Report for Q2 2026 on 2026-08-18 (Rapid7 Labs, 2026-08-18). One pair of numbers carries the argument: "There were 8,539 new high- and critical-severity CVEs (CVSS 7.0–10.0) this quarter- double the number reported in the same quarter last year (4,268)," while the count of vulnerabilities newly observed under exploitation "held roughly steady (40)" — a comparison the report makes without stating the period it is against, in a paragraph whose preceding sentence is year-on-year. Rapid7 is explicit that the finding is not an exploitation surge but a triage-capacity one — disclosure volume is far outstripping what any team can work through.

Three further measurements give that a defensive shape. First, the exploited set has moved further out of the user's hands: "Nearly two-thirds of exploited vulnerabilities this quarter (62%) required no user interaction - no stolen credentials, no phishing victim, no click," up nine points from 53% in Q2 2025 — meaning awareness training and phishing-resistant authentication, whatever else they buy, are addressing a shrinking share of what actually gets exploited. Second, disclosures of missing-authentication flaws (CWE-306) rose 247% year on year, which Rapid7 frames as a fast-expanding pool of internet-facing systems requiring no login at all; that is a category where an asset-exposure question answers the risk question directly, without needing a severity score. Third, on the intrusion side, Qilin led ransomware activity with 263 listed victims, the United States remained the most-targeted country, and business services and healthcare were among the hardest-hit sectors — while ClickFix and fake-CAPTCHA campaigns together with social engineering through trusted collaboration platforms such as Microsoft Teams accounted for 31.8% of the incidents Rapid7's incident-response team worked. Rapid7 also records continued Iranian, North Korean and Russian state-nexus activity against government, finance, healthcare, manufacturing, energy and telecommunications, with Russian campaigns focused on edge infrastructure and Iranian activity including sustained ICS and OT targeting.

Rapid7's own conclusion is a prioritisation argument rather than a patching one: as disclosures keep growing, the organisations that stay ahead will not be the ones patching fastest but the ones that know what they expose, which assets matter most, where an attacker can realistically get in, and how to reduce reachable exposure before it becomes an incident.