On October 22, 2026, Rapid7’s latest Quarterly Threat Landscape report put a hard number on a shift many security leaders have sensed but struggled to quantify. Forty-three vulnerabilities were newly exploited in the third quarter of 2026, up 19% year over year, and attackers packaged some flaws into working exploits within as little as three days.
That figure sounds manageable until you set it against the other side of the ledger. The volume of high-severity CVEs and public exploit code is growing at a pace no security team can match, while the list of flaws attackers actually weaponize remains comparatively short. For mid-market IT leaders running lean teams, that gap is the most important fact in vulnerability management today. It makes exploited vulnerability prioritization the discipline that separates organizations that stay ahead of attackers from organizations that spend every quarter chasing scanner output.
This article breaks down what the Rapid7 data, CSO Online’s reporting, and the broader breach research say about the flaw profile attackers target most. It explains why patch-everything strategies are collapsing under their own weight, and it lays out how to build a defense model that is not only faster but also measurably tied to business risk.
Exploited Vulnerability Prioritization Starts With the Attacker’s Shortlist
The headline number from Rapid7 is easy to misread. A 19% year-over-year rise in newly exploited vulnerabilities looks like a gradual, predictable climb. Douglas McKee, director of vulnerability intelligence at Rapid7, cautioned against exactly that interpretation in his comments to CSO Online.
“New high-severity CVEs, the ones rated 7 through 10, are up 133% year over year, and publicly available proof-of-concept code is up around 86% over the same stretch,” McKee said. “So the pile of things that could be exploited is growing far faster than the set of things attackers are actually choosing to exploit.”
Read that carefully, because it inverts the instinct most security programs are built on. The universe of risk on paper is expanding at a rate no mid-market team can absorb. The set of vulnerabilities that actually produce intrusions is growing too, but far more slowly, and it is concentrated. Attackers are behaving like disciplined investors. They are not chasing every new CVE. They are betting on a narrow portfolio of flaws that offer reliable access, broad reach, and low effort.
Rapid7 also found that the majority of underground forum posts referenced CVEs already documented in vendor advisories or by the US Cybersecurity and Infrastructure Security Agency (CISA). In plain terms, criminals are largely discussing and trading exploits for vulnerabilities that defenders have already been warned about. The problem is not a lack of warning. The problem is that the warning gets buried inside a backlog of findings that all look urgent, carry similar severity labels, and compete for the same scarce engineering hours.
For a CFO or COO, this reframes vulnerability management from an open-ended cost center into a targeting problem. Security spending is rarely wasted because teams patch too little. It is wasted because effort is spread evenly across risk that is distributed unevenly. Every hour spent on a critical-rated flaw that no attacker will ever touch is an hour not spent closing the door that an attacker is already testing.
The backlog is not the threat. The shortlist is.
The Three-Day Window Rewrites the Patch Calendar
CSO Online reported that attackers are packaging flaws into exploits within as little as three days. That single data point should force a hard look at how most mid-market organizations schedule remediation.
Many IT departments still operate on a monthly cadence anchored to vendor release cycles such as Microsoft’s Patch Tuesday, with testing windows, change advisory board approvals, and maintenance windows layered on top. That rhythm made sense when the gap between disclosure and weaponization was measured in weeks or months. It does not hold when a functional exploit can circulate before the first change ticket is approved.
The practical consequence is a structural exposure window. If an organization needs 30 days to move a critical patch into production and an attacker needs three days to weaponize the underlying flaw, the business carries open risk for most of a month on every vulnerability that matters. Multiply that by the number of internet-facing systems in a typical mid-market environment, including firewalls, VPN gateways, remote access portals, and public web applications, and the cumulative exposure becomes significant.
This is where the flaw profile becomes decisive. No organization can compress every patch into a 72-hour cycle. Attempting it would overwhelm change management, exhaust staff, and destabilize production systems. What teams can do is identify the small subset of vulnerabilities that match attacker preferences and give those an emergency lane, while everything else moves through the normal cadence. Speed becomes affordable precisely because it is selective.
The business translation is straightforward. A selective emergency lane protects revenue-generating systems from the attacks most likely to hit them, without forcing the rest of IT into a permanent state of firefighting. It also gives leadership a defensible answer when boards, auditors, or cyber insurers ask how the organization responds to actively exploited flaws.
What the Breach Data Says About Where Attackers Enter
Rapid7’s quarterly view is consistent with the largest annual breach studies. Mandiant’s M-Trends 2025 report, published by Google Cloud Security, tracks how attackers first gained access in the incidents its responders investigated during 2024.
The M-Trends 2025 data shows exploits sitting at the top of Mandiant’s initial infection vectors, ahead of stolen credentials and email phishing. That ordering matters for budget conversations. Many mid-market security investments still skew heavily toward email filtering and awareness training. Those controls remain essential, and phishing remains a serious threat. But frontline incident response data says that exploitable software is the most common way attackers get in, which means patch velocity and exposure management deserve at least equal standing in the security budget.
Verizon’s 2025 Data Breach Investigations Report points in the same direction. As reported by Infosecurity Magazine, the DBIR recorded a 34% jump in vulnerability exploitation as an initial access vector for breaches.
The DBIR chart places vulnerability exploitation alongside credential abuse and phishing as one of the leading ways breaches begin. Two independent datasets, built from different methodologies and different sample populations, arrive at the same conclusion: exploitation of known flaws is a primary entry route, not an edge case. And a 34% rise in a single year signals a trend that is accelerating rather than stabilizing.
For executives, this convergence removes ambiguity. When quarterly threat intelligence from Rapid7, a frontline incident response dataset from Mandiant, and the industry’s most widely cited breach report all agree, the case for re-centering defense on exploited vulnerabilities is not a vendor pitch. It is the evidence. Organizations that continue to allocate security resources based on habit rather than on how breaches actually start are funding yesterday’s threat model.
Zero-Days Get the Headlines, Known Flaws Do the Damage
None of this means zero-days are irrelevant. Google’s Threat Intelligence Group reported 75 zero-day vulnerabilities exploited in the wild in 2024, according to The Hacker News.
The trend line shows zero-day exploitation as a persistent, multi-year reality rather than a one-off spike. Sophisticated actors, including state-sponsored groups and commercial surveillance vendors, will keep investing in flaws that no patch can yet address. Google’s analysis also flagged a growing share of zero-days aimed at enterprise technologies, particularly security and networking products. That is a direct concern for any organization whose perimeter depends on the very appliances being targeted.
Here is the strategic point. Seventy-five zero-days across a full year, spread across the entire global target set, is a small number compared with the volume of known, documented, patchable vulnerabilities that attackers exploit against organizations that have not applied available fixes. Rapid7’s finding that most underground chatter centers on CVEs already in vendor advisories reinforces it. For the typical mid-market organization, the realistic path to a breach runs through a known flaw with a patch available, not through a novel exploit developed by a nation-state.
Zero-day defense still has a place, and it looks different from patching: behavioral detection, network segmentation, least privilege, and rapid containment. Those controls also blunt attacks against known flaws, which is why a mature program treats them as shared infrastructure rather than separate projects. The investment protects against both categories at once.
Defining the Flaw Profile Attackers Target Most
If attackers concentrate on a narrow shortlist, defenders need a working definition of what lands on it. Drawing on the Rapid7 findings and the breach research above, the profile consistently combines several characteristics.
- Internet exposure. Flaws in systems reachable from the internet, including VPN gateways, firewalls, remote access portals, file transfer platforms, and public web applications, give attackers a direct path without needing an existing foothold.
- High severity with real impact. Remote code execution, authentication bypass, and privilege escalation flaws convert directly into control. Because the volume of CVEs rated 7 through 10 is rising sharply, severity is a starting filter, not a decision.
- Public exploit code. Proof-of-concept availability, up around 86% year over year per Rapid7, lowers the skill bar and shortens the time from disclosure to weaponization.
- Public documentation. Vulnerabilities already described in vendor advisories or listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog are the ones underground forums discuss most.
- Broad install base. Flaws in widely deployed platforms such as hypervisors, identity systems, email servers, and network appliances offer attackers scale: one exploit, many victims.
- Pre-authentication access. Flaws that require no valid credentials are prized because they remove the hardest step in an intrusion.
A vulnerability that checks four or five of these boxes deserves emergency treatment regardless of where it sits in the scanner’s default sort order. A vulnerability that checks only one, such as a high CVSS score on an isolated internal system with no public exploit, can usually move through the standard cycle without materially changing risk. That distinction is the core of the entire model, and it is what allows a small team to behave like a large one.
A monthly patch cycle is a policy written for an attacker who no longer exists.
Why CVSS Scores Alone Cannot Carry the Load
The Common Vulnerability Scoring System was designed to describe the technical severity of a flaw. It was never designed to predict whether a given flaw will be exploited against a given organization. When new high-severity CVEs grow 133% in a year, as Rapid7 reported, a policy that says “patch everything rated 7 or higher within 14 days” quietly becomes impossible to honor.
The result is predictable. Teams fall behind, exceptions pile up, and the backlog becomes background noise that nobody trusts. Worse, a severity-only model assigns the same urgency to a critical-rated flaw in an internal reporting tool as to a critical-rated flaw in an internet-facing VPN appliance under active exploitation. Treating those two as equals is how organizations end up fully compliant with their own patch policy and still breached.
Better inputs already exist. CISA’s KEV catalog lists vulnerabilities with confirmed exploitation in the wild. The Exploit Prediction Scoring System (EPSS), maintained by FIRST, estimates the likelihood that a vulnerability will be exploited. Commercial threat intelligence and managed detection providers add context about which flaws are trending in active campaigns. Combined with an accurate understanding of which assets are exposed and which hold sensitive data, these signals turn a flat list into a ranked one.
The payoff is not only lower risk but also lower operational cost. When teams stop spending emergency effort on findings that do not matter, maintenance windows shrink, rushed changes become rarer, and senior engineers get time back for architecture and modernization work that moves the business forward.
Building an Exploited Vulnerability Prioritization Program That Holds
Re-centering defense on the attacker’s shortlist does not require a new tool category or a larger headcount. It requires a deliberate operating model. Mid-market organizations that make this shift successfully tend to build it in five layers.
1. Know What Is Exposed
Prioritization fails without an accurate inventory. That means not only servers and endpoints but also network appliances, hypervisors, SaaS integrations, and the forgotten remote access portal a vendor set up years ago. External attack surface scanning, combined with internal asset discovery, gives teams a reliable picture of what attackers can see first. If a system is not in the inventory, it cannot be prioritized, and unknown internet-facing assets are exactly the ones attackers find.
2. Feed Real Exploitation Signals Into Triage
Integrate CISA KEV updates, EPSS scores, and threat intelligence directly into vulnerability management workflows so findings arrive already ranked. When a CVE moves onto the KEV catalog, that change should automatically raise its priority and notify the system owner, not wait for someone to notice it in a weekly report. Automation here is not a luxury. With exploits appearing in as little as three days, manual triage consumes the entire response window.
3. Create a Tiered Remediation Lane
Define at least two service levels. An emergency lane covers vulnerabilities that match the attacker profile: internet-facing, actively exploited or backed by public exploit code, and high impact. Given the three-day weaponization window reported by CSO Online, the emergency lane should target remediation or mitigation in days, not weeks. A standard lane handles everything else on the normal maintenance cadence. Pre-approve the emergency process with change management leadership so speed never depends on heroics or late-night escalations.
4. Use Compensating Controls When Patching Has to Wait
Some systems cannot be patched quickly because of vendor certification requirements, uptime commitments, or legacy dependencies. For these, compensating controls buy time: restricting management interfaces to trusted networks, enforcing multi-factor authentication on remote access, applying virtual patching through next-generation firewall intrusion prevention or web application firewall rules, and segmenting the vulnerable system away from crown-jewel data. Fortinet’s firewall portfolio and CrowdStrike’s endpoint protection give teams layered options to detect and contain exploitation attempts while a permanent fix is staged and tested.
5. Validate and Measure
Track metrics that reflect risk rather than activity. Mean time to remediate emergency-lane vulnerabilities, the share of internet-facing assets with KEV-listed flaws still open, and the age of the oldest exploited vulnerability in the environment tell leadership far more than the total count of patches applied. Validate closure with rescans and, where possible, attack simulation. A patch that was deployed but failed silently is worse than no patch, because it creates false confidence.
Mapping the Strategy to the Five Pillars
Exploited vulnerability prioritization is a security practice, but its value shows up across every dimension of infrastructure strategy.
- Simplification: Replacing a flat, overwhelming backlog with a ranked shortlist reduces decision fatigue. Teams work from one prioritized queue instead of reconciling competing scanner reports.
- Security: Closing the flaw profile attackers target most first addresses the specific doors that Mandiant and Verizon data show attackers use to get in.
- Performance: Fewer emergency changes on low-risk findings mean fewer unplanned reboots and more stable production systems for the business.
- Resilience: Compensating controls and tested recovery ensure that if an exploit lands before the patch, operations continue and restoration is predictable.
- Flexibility: A risk-based model applies consistently across on-premises, private cloud, and hybrid environments, so priorities hold as workloads move.
When the Race Is Lost: Recovery Belongs in Vulnerability Strategy
A three-day weaponization window means some organizations will lose the race on some flaws, no matter how disciplined they are. A complete strategy accounts for that reality instead of pretending prevention is perfect. Exploitation of an edge device or hypervisor is frequently the opening move of a ransomware intrusion, and ransomware operators increasingly go after backup infrastructure to remove the victim’s ability to recover without paying.
This is why vulnerability prioritization and recovery engineering belong in the same conversation. Immutable, isolated backups built on Veeam, combined with a tested failover plan, turn a successful exploit from an existential event into a recoverable incident. IT Vortex delivers that layer through Backup as a Service (BaaS) and Disaster Recovery (DRaaS), architected to keep recovery points isolated from the production environment an attacker is most likely to compromise.
Recovery capability also sharpens prioritization itself. When leaders know exactly how long it takes to restore a given system, they can weigh patch urgency against recovery confidence and make informed tradeoffs instead of guesses. A system with a proven, fast restore path can tolerate a short delay for testing. A system without one cannot, and it should move to the front of the emergency lane.
Where IT Vortex Fits
Most mid-market organizations do not lack security tools. They lack the time and specialized staff to turn threat intelligence into daily operational decisions. IT Vortex closes that gap as an integrator, architect, and advisor, not a reseller of licenses.
Through Security as a Service (SECaaS), IT Vortex combines layered protection from partners including Fortinet, CrowdStrike, and Proofpoint with the operational discipline to act on exploitation signals quickly. Our Managed Services teams handle patch orchestration, compensating controls, and change coordination so the emergency lane actually moves at the speed the threat data demands. For workloads running on Cloud Hosting (IaaS), built on VMware and delivered by IT Vortex as a Premier Broadcom VCSP Partner, the underlying platform is managed as part of the service, so infrastructure-layer vulnerabilities are addressed by specialists rather than left sitting in an internal queue.
The goal is not to generate more findings. It is to make sure the handful that matter get closed first, every time, with a recovery backstop in place for the moment an attacker moves faster than the fix.
Stop Counting CVEs and Start Counting Open Doors
The Rapid7 data makes a counterintuitive case. The danger is not simply that the number of vulnerabilities is exploding, although it is. The danger is that defenders keep treating that explosion as the problem to solve, while attackers quietly work a short, predictable list.
Every mid-market IT leader should be able to answer three questions this quarter. Which internet-facing systems in our environment carry vulnerabilities that are actively exploited or backed by public exploit code? How many days would it take us to remediate or mitigate one of them? And if an attacker got there first, how quickly could we restore the business?
Vulnerability management is no longer a volume problem. It is a targeting problem, and attackers have already picked their targets.
If those answers are unclear, the gap is not in your scanner. It is in your operating model. IT Vortex can help you map the flaw profile attackers target most against your actual environment, define an emergency remediation lane your change process can support, and validate the recovery backstop behind it. Schedule a working session with Lou Corriero, VP Cloud, and leave with a prioritized view of the doors that need to close first.
