N-day attacks are accelerating as threat actors use disclosed vulnerabilities to compromise systems before organisations can patch them. New Google Threat Intelligence Group research suggests AI tools may be shortening the path from a public advisory to a working exploit.
GTIG analysed vulnerability disclosure and exploitation data from 1 January 2025 to 31 August 2026. Its findings, first reported publicly on 30 September 2026, show that exploitation increased sharply during the first eight months of 2026, with activity focused on known high-risk flaws rather than an equivalent surge in previously unknown zero-days.
N-Day Attacks Exceed the 2025 Exploitation Total
GTIG recorded 141 vulnerabilities exploited in the wild between January and August 2026. That eight-month figure had already exceeded the 127 vulnerabilities observed throughout 2025.
The average number of vulnerabilities exploited each month rose from 10.5 in 2025 to about 18 in 2026 through August. Exploited high-risk vulnerabilities increased even more sharply, from 28 during all of 2025 to 75 in the first eight months of 2026.
Monthly CVE disclosures also more than doubled. GTIG counted 5,045 disclosures in January 2026 and 10,740 in August. This created a substantially larger pool of public vulnerability information for defenders to assess and attackers to examine.
However, exploitation affected only a small proportion of published flaws. Approximately 0.23 per cent of disclosed vulnerabilities, or about one in 431, were exploited. The important change was not that every CVE had become dangerous, but that attackers were operationalising selected vulnerabilities more quickly.
Zero-days were not the main source of growth
GTIG attributed most of the increase to n-day attacks, meaning attacks against vulnerabilities that have already been disclosed. Its monthly zero-day measure increased only modestly, from 8 in 2025 to 11 through August 2026, while the overall monthly exploitation rate rose much faster.
This distinction matters because defenders have information and, in many cases, patches for n-day vulnerabilities. The operational challenge is identifying which advisories require immediate action before attackers turn the published technical details into reliable intrusion methods.
How AI May Accelerate N-Day Attacks
GTIG assesses that large language models and other AI tools can help attackers automate labour-intensive parts of exploit development. These tools can compare vulnerable and patched product versions, analyse vendor advisories, interpret proof-of-concept code and identify the exact software changes intended to correct a flaw.
This process, often called patch diffing, is not new. AI can make it faster and more accessible by processing code and documentation at scale. An attacker may therefore need less time and specialist effort to understand a disclosed weakness, create a working exploit and test it against exposed systems.
A BeyondTrust Privileged Remote Access case highlighted the speed involved. Following disclosure of an unauthenticated command-injection vulnerability, one threat cluster exploited it within four days. Five more clusters were exploiting it within seven days.
Observed follow-on activity included privilege escalation, data exfiltration and the deployment of secondary payloads. These included SparkRAT and commodity cryptominers. GTIG did not publish campaign-specific IP addresses, file hashes or other indicators of compromise with its broader trend report.
Separate VulnCheck research provides further evidence that exploitation is accelerating. During the first half of 2026, the median time between CVE publication and evidence of exploitation fell to 80 days, compared with 120 days in 2025. Disclosure growth still outpaced exploitation growth, but the window available for patching selected high-risk flaws became shorter.
Edge Appliances Face Concentrated Exploitation
N-day attacks were not spread evenly across technology categories. Edge and security appliances accounted for 14 per cent of exploited vulnerabilities, and more than two thirds of those flaws were rated high or critical under GTIG’s risk model.
Enterprise directory and collaboration hubs accounted for another 11 per cent. These products can provide valuable access because they sit at organisational boundaries, manage identities or connect users and business systems.
Many edge devices expose web management or messaging interfaces directly to the internet. An unauthenticated command-injection flaw can allow a remote attacker to send operating system commands without valid credentials, while a buffer overflow may permit code execution by sending specially constructed data.
These devices can also lack the endpoint monitoring agents commonly installed on laptops and servers. Malicious activity may consequently remain outside the visibility of endpoint detection and response platforms.
Products contributing to the disclosure increase
Totolink patched 75 high-risk flaws in consumer router firmware during April and May 2026, contributing to a mid-year rise in command execution vulnerabilities. Representative affected products included:
-
Totolink A7000R firmware up to 9.1.0u.6115, affected by a stack buffer overflow in the setWiFiEasyGuestCfg function.
-
Totolink CA750-PoE firmware 6.2c.510, affected by command injection in the setPasswordCfg function.
-
Totolink T6 firmware 4.1.5cu.748_B20211015, affected by incorrect access control that could permit unauthenticated MQTT-triggered firmware updates.
Oracle’s August 2026 Critical Security Patch Update addressed 943 issues across multiple product families, including Fusion Middleware and WebLogic. Oracle advisories, together with Linux kernel network driver records, contributed to 128 high-risk vulnerabilities disclosed during August.
Why Raw CVE Totals Need Context
GTIG cautioned that the doubling of monthly disclosures does not translate directly into a doubling of organisational risk. Automated CVE Numbering Authority practices, particularly across open-source ecosystems, can increase the number of records without producing a comparable increase in actively exploited weaknesses.
Approximately 5,000 Linux kernel-labelled CVEs were recorded between January and August 2026. GTIG observed no in-the-wild zero-day exploitation associated with that group during the period.
The finding reinforces the need to distinguish disclosure volume from practical exposure. Internet accessibility, authentication requirements, exploit availability, threat activity and the consequences of compromise are more useful prioritisation factors than the number of CVEs attached to a product.
Responding to Faster N-Day Attacks
Organisations should give urgent attention to vendor advisories covering internet-facing routers, firewalls, remote access platforms, identity systems and collaboration services. Products with unauthenticated management interfaces or known command-execution paths warrant particularly rapid review.
Immediate priorities arising from the GTIG findings include:
-
Identify externally exposed appliances and verify their exact models, firmware versions and management interfaces.
-
Prioritise high-risk vulnerabilities with evidence of exploitation or rapidly available proof-of-concept code.
-
Apply vendor updates or mitigations within days where a perimeter flaw allows unauthenticated access.
-
Review logs for unexpected administrative actions, privilege changes, outbound connections and cryptomining activity.
The 2026 data does not suggest that every published vulnerability will be attacked. It shows that selected n-day attacks can spread among multiple threat clusters within a week, making threat-led prioritisation and fast action on exposed systems increasingly important.
Originally reported by csoonline.com.
