Rapid7 Report: Exploited Software Flaws More Than Doubled in 2025

The cybersecurity landscape underwent a seismic shift in 2025 as the volume of exploited high and critical software vulnerabilities more than doubled compared to the previous year. According to the latest research from Rapid7, this surge is not just a statistical anomaly but a reflection of a fundamental change in how threat actors operate. The primary driver behind this escalation is the dramatic compression of the disclosure-to-attack window—the period between a vulnerability becoming public knowledge and its active exploitation in the wild.

In previous years, organizations often had a grace period of days or even weeks to test and deploy patches. However, the 2025 data suggests that this window has effectively collapsed. Attackers are now leveraging automated scanning and AI-assisted exploit development to weaponize new vulnerabilities within hours of their announcement. This N-day exploitation cycle has become so efficient that it often outpaces the internal change management processes of even the most sophisticated enterprises. The report highlights that high and critical flaws are being prioritized by attackers because they offer the path of least resistance to sensitive data and administrative control.

“

According to the latest research from Rapid7, this surge is not just a statistical anomaly but a reflection of a fundamental change in how threat actors operate.

The industry context for this trend is particularly concerning. As organizations increasingly rely on a complex web of cloud services, edge devices, and third-party software, the attack surface has expanded beyond the traditional perimeter. Rapid7’s findings indicate that edge technologies—such as VPNs, firewalls, and load balancers—have become primary targets. These devices often sit outside the standard visibility of endpoint detection tools, making them ideal entry points for initial access. The doubling of exploited flaws suggests that attackers are no longer just looking for zero-days but are finding immense success in the rapid exploitation of known, high-impact vulnerabilities that remain unpatched.