Rapid7 report says 62% of newly exploited Q2 2026 vulnerabilities require no user interaction
RPD•Zero-click flaws and missing-authentication disclosures rose
Zero-click flaws accounted for 62% of newly exploited vulnerabilities, enabling network exploitation without authentication or user interaction.
Critical vulnerability volume increased 21% quarter over quarter; public proof-of-concept code rose 12% quarter over quarter, 76% year over year.
Missing-authentication disclosures jumped 247% year over year to 156, widening exposure for internet-facing systems.
Rapid7 threat report highlights faster vulnerability weaponization
Rapid7’s Q2 2026 threat report flagged faster vulnerability weaponization, challenging periodic patch cycles reliant on static CVSS severity scoring.
High and critical vulnerability disclosures doubled year over year to 8,539; newly exploited vulnerabilities rose up to 40%.
