Vulnerability Exploitation Overtakes Social Engineering As Top Attack Vector, Rapid7 Report Finds

Vulnerability exploitation has surpassed social engineering as the leading way attackers gain initial access to systems, according to Rapid7’s Q1 2026 Threat Landscape Report.

Exploitation accounted for 38 per cent of incident response cases during the quarter, followed by social engineering at 24 per cent and compromised accounts at 14 per cent. The shift reflects what Rapid7 describes as the growing role of AI in accelerating how quickly attackers can identify, weaponise and exploit unpatched systems.

The report also found a 105 per cent year-on-year increase in exploited high and critical vulnerabilities.

Zero-click flaws dominate

Half of the vulnerabilities actively exploited in the wild during Q1 were zero-click, network-facing issues requiring no authentication or user interaction. This gives attackers direct access to exposed systems without relying on human action.

Among high and critical-severity vulnerabilities, the median time from public disclosure to inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalogue fell from 8.5 days to 5.0 days, compressing the window available to defenders.

Raj Samani, SVP and Chief Scientist at Rapid7, argued the findings challenge longstanding assumptions about where security risk is concentrated.

“We’ve spent years building a security culture around humans being the weakest link, but our Q1 findings show AI is quietly rewriting that equation,” Samani observed. “Attackers are increasingly bypassing user interaction altogether, prioritising direct access to exposed infrastructure and dramatically narrowing the window defenders have to respond.”

SQL injection rises, ransomware fragments

SQL injection overtook OS command injection as the most exploited vulnerability type during Q1, reflecting attacker focus on common, broadly distributed web application weaknesses.

The report found that exploited vulnerabilities averaged 1.8 million mentions across blogs, forums and social media, indicating that widely discussed vulnerabilities can quickly become operational targets for attackers.

Ransomware activity remained fragmented across multiple operators. Qilin led leak-site activity with 357 posts, followed by The Gentlemen with 206 and Akira with 174.

Abused Remote Monitoring and Management (RMM) tools were the most prevalent threat category observed, accounting for 22.9 per cent of activity. ClickFix followed at 18.8 per cent and Windows Native Scripts at 10.4 per cent.

Pressure on security teams

Christiaan Beek, Vice President of Cyber Intelligence at Rapid7, pointed to the challenge facing security operations teams as exploitation timelines continue to shrink.

“Q1 shows how quickly exposed systems can become operational targets,” Beek warned. “Security teams can’t apply the same level of investigation and response across every signal when attackers are consistently prioritising what they can reach and exploit. That gap is where risk accumulates.”

The full Q1 2026 Threat Landscape Report is available on Rapid7’s website. The report draws on select tracked CVEs, MDR incident response data, ransomware leak-site intelligence and dark web telemetry.

Last Updated on May 22, 2026 by Nick Ross